CVE-2021-39895

CVE-2021-39895 affects all versions of GitLab CE/EE since 8.0, allowing an attacker to configure pipeline schedules to be active within a project export. When an unsuspecting user imports such a project, these pipelines become active by default, potentially leading to information disclosure under specific circumstances if the project originates from an untrusted source. The vulnerability has a CVSS score of 4.5 (Medium), indicating a network attack vector with low complexity, requiring high privileges and user interaction to achieve high confidentiality impact. There is no evidence of active exploitation, nor are there public exploit modules like Metasploit or Nuclei, though it has received some community discussion and media coverage.