CVE-2019-11547

CVE-2019-11547 is an improper output encoding vulnerability affecting GitLab Community and Enterprise Editions before versions 11.8.9, 11.9.10, and 11.10.2. Specifically, unescaped branch names in new merge request notification emails could lead to Cross-Site Scripting (XSS) attacks. This vulnerability has a CVSS score of 6.1 (Medium), indicating it can be exploited over the network with low attack complexity, requiring user interaction, and potentially leading to low impact on confidentiality and integrity. There is no evidence of active exploitation, nor are there publicly available exploit modules like Metasploit or Nuclei. Despite limited community discussion and media coverage, the vendor released security updates to address this flaw.