Vulnerabilities & Exploits

GitLab’s CI/CD Regex Path Leads to Server RCE

GitLab released fixes for 11 CE/EE vulnerabilities affecting versions from 13.11 through 19.4.x, including two critical flaws that can let an authenticated user reach remote code execution on the GitLab server. The vendor and INCIBE-CERT say patched builds are 19.2.7, 19.3.3, and 19.4.1 or later.

The critical bugs sit in regular expression handling inside CI/CD configuration. A signed-in user can submit a specially crafted regex through pipeline rules, and GitLab’s parser/compiler mishandles it badly enough that the input can become arbitrary code execution on the server. In other words, a feature meant to shape builds becomes part of the attack surface.

For teams that let developers or project members edit pipeline logic, the trust boundary is wider than “authenticated equals safe.” A compromised or malicious account with repo-level access can move from config changes to host compromise, and GitLab Dedicated customers are the exception because GitLab says they do not need to act.

2 sources · 6h ago

CVE-2026-89078

NVD KEV

CVSS 9.9 CRITICAL: gitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3…

CVE-2026-93577

NVD KEV

CVSS 9.9 CRITICAL: gitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3…

Timeline

Sources

Part of the PlainSec briefing for 2026-09-24

Every edition of this story: GitLab’s CI/CD Regex Path Leads to Server RCE

More from today