CVE-2026-89078
CVSS 9.9 CRITICAL: gitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3…
Vulnerabilities & Exploits
GitLab released fixes for 11 CE/EE vulnerabilities affecting versions from 13.11 through 19.4.x, including two critical flaws that can let an authenticated user reach remote code execution on the GitLab server. The vendor and INCIBE-CERT say patched builds are 19.2.7, 19.3.3, and 19.4.1 or later.
The critical bugs sit in regular expression handling inside CI/CD configuration. A signed-in user can submit a specially crafted regex through pipeline rules, and GitLab’s parser/compiler mishandles it badly enough that the input can become arbitrary code execution on the server. In other words, a feature meant to shape builds becomes part of the attack surface.
For teams that let developers or project members edit pipeline logic, the trust boundary is wider than “authenticated equals safe.” A compromised or malicious account with repo-level access can move from config changes to host compromise, and GitLab Dedicated customers are the exception because GitLab says they do not need to act.
2 sources · 6h ago
CVSS 9.9 CRITICAL: gitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3…
CVSS 9.9 CRITICAL: gitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3…
CSIRT Italia / ACN
Risolte vulnerabilità su GitLab CE/EE
Rilasciati aggiornamenti di sicurezza che risolvono 7 vulnerabilità, di cui una con gravità “alta” e 2 con gravità “critica”, in GitLab Community Edition (CE) ed Enterprise Edition (EE).
originalINCIBE-CERT
Múltiples vulnerabilidades en GitLab
Los investigadores joaxcar, ahacker1, rogerace y scyoon, junto con varios miembros del equipo de GitLa
originalPart of the PlainSec briefing for 2026-09-24
Every edition of this story: GitLab’s CI/CD Regex Path Leads to Server RCE