Weekly recap: PHP2Shell scans, Plex2Shell attacks, LiteLLM supply chain
CISA listed four exploited Plex flaws, while a leaked LiteLLM key led to a malicious Python package release.
78
Vulnerability5 · 2 reads
CVE-2026-89078
Authenticated RCE in GitLab CE/EE via Double Free in CI/CD Regex Parsing
- CVSS 3.1
- 9.9 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
GitLab CE/EE contains a double free (CWE-415) memory corruption flaw in the code that parses regular expressions in CI/CD pipeline configurations. An authenticated attacker — for example a user who can create a project or edit a .gitlab-ci.yml file containing a specially crafted regular expression — can trigger the bug during config parsing and execute arbitrary code on the GitLab server itself. The CVSS 3.1 base score is 9.9 (critical), reflecting low-privilege authentication requirements but full compromise of server confidentiality and integrity with scope change, since code runs outside the application's normal context. All self-managed installations from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 are affected; GitLab.com (the vendor's SaaS offering) is centrally managed and not exposed to unpatched customer instances. There is no known public proof-of-concept, the issue is not on the CISA KEV list, and no exploitation has been reported, though GitLab instances are high-value targets for source-code and secrets theft.
What to do: Upgrade self-managed instances immediately to 19.2.7, 19.3.3, or 19.4.1 (or later) matching your minor release track. Until patched, restrict who can create projects or edit CI/CD configuration files, and review recent .gitlab-ci.yml commits for unusual or overly complex regular expressions. Audit GitLab server logs and CI/CD job history for anomalous pipelines or unexpected process activity originating from the GitLab application host.
| Product | Affected |
|---|---|
| GitLab Community Edition (CE) | >= 19.2 and < 19.2.7; >= 19.3 and < 19.3.3; >= 19.4 and < 19.4.1 |
| GitLab Enterprise Edition (EE) | >= 19.2 and < 19.2.7; >= 19.3 and < 19.3.3; >= 19.4 and < 19.4.1 |
Estimated exposure
largeTens of thousands of internet-exposed self-managed GitLab instances, of which only the subset running unpatched 19.2–19.4 are vulnerable (likely thousands to… — Public internet-wide scans (Shodan/FOFA-type sources) consistently show on the order of tens of thousands of self-managed GitLab CE/EE instances reachable on the open web; GitLab.com SaaS users are unaffected because patching is handled by…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a specially crafted regular expression in a CI/CD configuration.
In the news
2 storiesCritical GitLab Bugs Let Attackers Execute Code Through Malicious CI/CD Regex
GitLab patched two CVSS 9.9 flaws letting authenticated users execute code via malicious CI/CD regular expressions.
74