Weekly recap: PHP2Shell scans, Plex2Shell attacks, LiteLLM supply chain
CISA listed four exploited Plex flaws, while a leaked LiteLLM key led to a malicious Python package release.
78
Vulnerability6 · 2 reads
CVE-2026-93577
Authenticated RCE via Regex Integer Overflow in GitLab CE/EE CI/CD
- CVSS 3.1
- 9.9 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
GitLab CE/EE contains an integer overflow (CWE-190) in the regular expression compiler that can be triggered when compiling a specially crafted regex embedded in a CI/CD configuration. An authenticated user with the ability to create or edit CI/CD pipelines can exploit this to execute arbitrary code on the GitLab server itself, with potential full impact on confidentiality, integrity, and availability across the application boundary (CVSS 9.9). All self-managed instances from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 are affected. GitLab has released patched versions, and no public proof-of-concept or confirmed in-the-wild exploitation is known at this time.
What to do: Upgrade immediately to GitLab 19.4.1, or at minimum 19.3.3 or 19.2.7, depending on your release track. Until patched, restrict who can create or modify CI/CD pipelines and review recent pipeline configurations and audit logs for unusually complex or malformed regular expressions. Instances on these versions that expose CI/CD editing to broad internal user populations should be treated as higher priority.
| Product | Affected |
|---|---|
| GitLab Community Edition (CE) and Enterprise Edition (EE) | 19.2 before 19.2.7 |
| GitLab Community Edition (CE) and Enterprise Edition (EE) | 19.3 before 19.3.3 |
| GitLab Community Edition (CE) and Enterprise Edition (EE) | 19.4 before 19.4.1 |
Estimated exposure
moderatelikely a few thousand to tens of thousands of self-managed instances (subset of the ~20,000–30,000 internet-exposed GitLab servers seen in public scans that… — Public internet scans (Shodan/Censys-style) typically show tens of thousands of internet-facing GitLab instances, but only those recently upgraded to the 19.2–19.4 lines fall in the affected ranges, so I discounted the exposed total…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration.
In the news
2 storiesCritical GitLab Bugs Let Attackers Execute Code Through Malicious CI/CD Regex
GitLab patched two CVSS 9.9 flaws letting authenticated users execute code via malicious CI/CD regular expressions.
74