CVE-2026-89078
CVSS 9.9 CRITICAL: gitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3…
Vulnerabilities · 5h ago
GitLab released fixes for 11 CE/EE vulnerabilities affecting versions from 13.11 through 19.4.x, including two critical flaws that can let an authenticated user reach remote code execution on the GitLab server. The vendor and INCIBE-CERT say patched builds are 19.2.7, 19.3.3, and 19.4.1 or later.
The critical bugs sit in regular expression handling inside CI/CD configuration. A signed-in user can submit a specially crafted regex through pipeline rules, and GitLab’s parser/compiler mishandles it badly enough that the input can become arbitrary code execution on the server. In other words, a feature meant to shape builds becomes part of the attack surface.
For teams that let developers or project members edit pipeline logic, the trust boundary is wider than “authenticated equals safe.” A compromised or malicious account with repo-level access can move from config changes to host compromise, and GitLab Dedicated customers are the exception because GitLab says they do not need to act.
CVSS 9.9 CRITICAL: gitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3…
CVSS 9.9 CRITICAL: gitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3…
2 sources covering this story
Risolte vulnerabilità su GitLab CE/EE
Rilasciati aggiornamenti di sicurezza che risolvono 7 vulnerabilità, di cui una con gravità “alta” e 2 con gravità “critica”, in GitLab Community Edition (CE) ed Enterprise Edition (EE).
Múltiples vulnerabilidades en GitLab
Los investigadores joaxcar, ahacker1, rogerace y scyoon, junto con varios miembros del equipo de GitLa
Part of the PlainSec briefing for 2026-09-24