Launchpad.net

CVE 2021-39906

Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the victim's behalf.

See the CVE page on Mitre.org for more details.