# Stored XSS in Wiki pages

Wiki hierarchical-link markdown with a scheme-like page title converts `.alert(1);` into a `javascript:` href, yielding stored XSS on GitLab wiki pages.

- Payout: hidden
- Severity: high
- Program: GitLab
- Found by: ryhmnlfj
- Disclosed: 2019-09-02
- CVE: CVE-2019-5467
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/526325
- Library page: https://bugbountylibrary.com/r/h1%3A526325
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:high tech:ruby technique:source-review vuln:xss

**Target:** GitLab Wiki page markdown renderer
**Root cause:** The wiki hierarchical-link markdown converter treats the page title as a scheme prefix and strips everything after the colon, so a title like `javascript:` combined with `.alert(1);` produces a `javascript:alert(1);` href without scheme filtering.
**Steps:**
1. Sign in to GitLab and open a project where you can edit Wiki pages.
2. Create a new wiki page with Page slug `javascript:`.
3. Set Title `javascript:`, Format Markdown, Content `[XSS](.alert(1);)`.
4. Save the page and click the `XSS` link; the alert fires.
**How found:** Researcher tested wiki-specific hierarchical link markdown (`.` and `..`) and noticed the page title was being used as a scheme prefix, then tried a `javascript:` title to see if the resulting href was filtered.
**Exploitation:** Attacker with wiki edit rights creates a page whose title is a scheme like `javascript:` and content uses the `.` hierarchical link; any visitor clicking the rendered link executes attacker JS in the GitLab origin. On public projects with wiki visibility 'Everyone With Access', many users can be lured to click.
**Escalation:** Other schemes (`data:`, `vbscript:`) and disguised titles like `JavaScript::SubClassName.function_name` also work, widening payload options.
**Insight:** Wiki hierarchical-link markdown resolves relative links against the page title; when a title looks like a URL scheme, the renderer treats it as one. Test page titles/slugs as scheme prefixes for any markdown feature that builds hrefs from page metadata.