# Persistent XSS via e-mail when creating merge requests

Unsanitized branch names containing HTML/script tags were rendered in GitLab merge request notification emails, enabling persistent XSS in mail clients.

- Payout: hidden
- Severity: low
- Program: GitLab
- Found by: mario-areias
- Disclosed: 2019-08-30
- CVE: CVE-2019-5471
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/496973
- Library page: https://bugbountylibrary.com/r/h1%3A496973
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:low tech:email tech:ruby technique:source-review vuln:xss

**Target:** Merge request notification email templates (new_merge_request_email, repository_push_email)
**Root cause:** Branch names allow characters like `<>/` and are interpolated into HTML email templates (new_merge_request_email.html.haml line 6) without escaping, so attacker-controlled markup is rendered as HTML.
**Steps:**
1. Fork a public repository (e.g. HTML5 boilerplate)
2. Create a new file but set target branch to `<script>alert(1)</script>`
3. Open a New Merge Request from the fork's malicious branch to the original repo's master
4. Assign a maintainer of the original repo as reviewer and submit
5. Open `/rails/letter_opener/` and observe the alert firing in the rendered email
**How found:** Noticed branch names permit `<>/` characters and traced them into the HTML email templates, spotting unescaped interpolation at new_merge_request_email.html.haml line 6; also flagged repository_push_email.text.haml line 49 as likely similar.
**Exploitation:** Attacker forks a victim repo, creates a branch named `<script>alert(1)</script>`, opens an MR against the upstream and assigns a maintainer; the notification email renders the branch name as HTML. Alternatively, a repo owner adds arbitrary GitLab users as members and assigns them to review an MR in their own repo, delivering the malicious email to any GitLab user.
**Escalation:** Reach amplification: any GitLab user can be added as a member of an attacker-controlled repo and targeted with the malicious notification email, using GitLab's own domain to lend credibility.
**Insight:** Notification/email templates are a separate rendering path from the web UI — branch names, refs and other git-controlled strings that are escaped in-app often reach HTML mail templates raw; check every notify/*.haml that interpolates user-controlled ref names.