Critical GitLab Bugs Let Attackers Execute Code Through Malicious CI/CD Regex

GitLab has released emergency security updates to fix two critical vulnerabilities that could allow authenticated attackers to execute arbitrary code on vulnerable GitLab servers through specially crafted regular expressions in CI/CD configurations.

The flaws, tracked as CVE-2026-89078 and CVE-2026-93577, affect GitLab Community Edition and Enterprise Edition installations.

GitLab issued patched releases 19.4.1, 19.3.3, and 19.2.7 on September 23, 2026, and urged administrators of self-managed instances to upgrade immediately. GitLab.com is already running the fixed version, while GitLab Dedicated customers do not need to take action.

CVE-2026-89078 is a double-free vulnerability in GitLab’s regular expression parser. Under certain conditions, an authenticated user could submit a specially crafted regular expression through a CI/CD configuration and cause unsafe memory handling on the GitLab server.

A double-free occurs when software releases the same memory area more than once. Attackers can sometimes exploit this memory corruption condition to alter program execution, crash services, or run attacker-controlled code.

GitLab rated the flaw Critical with a CVSS score of 9.9. The vulnerability was reported through GitLab’s HackerOne bug bounty program by researcher joaxcar.

The second issue, CVE-2026-93577, is an integer overflow in the regular expression compiler. An integer overflow happens when a numerical value exceeds the range that a program expects or can safely store.

In this case, a malicious regex embedded in a CI/CD configuration could trigger the error during compilation and potentially enable arbitrary code execution on the GitLab server.

GitLab assigned CVE-2026-93577 a CVSS score of 9.9, indicating low attack complexity and severe consequences for confidentiality, integrity, and availability. Unlike the double-free issue, this vulnerability also carries a high availability impact in GitLab’s CVSS assessment.

GitLab Bugs Enable Code Execution

Both critical bugs affect GitLab CE and EE versions starting with 19.2 and continuing until the newly released security patches. Vulnerable installations include GitLab 19.2 versions before 19.2.7, GitLab 19.3 versions before 19.3.3, and GitLab 19.4 versions before 19.4.1.

The attack requires authentication, meaning an attacker must have access to a GitLab account. However, this condition should not reduce the urgency of patching.

Many GitLab environments provide accounts to developers, contractors, external collaborators, or CI/CD users. A low-privileged account could become a path to compromise the GitLab application server itself.

Because GitLab servers often host source code, CI/CD secrets, deployment credentials, project variables, and access tokens, successful server-side code execution could create a major supply-chain risk.

An attacker who gains control of a GitLab server may attempt to access private repositories, steal pipeline secrets, modify build logic, or target connected development infrastructure.

GitLab’s patch release fixes the high-severity XSS flaw CVE-2026-84739 in the merge request diff viewer, which could allow authenticated users to execute JavaScript in another user’s browser session (CVSS 8.7).

GitLab also fixed CVE-2026-92470, a high-severity authorization issue affecting the Duo AI job troubleshooting feature in GitLab EE. The vulnerability could let an authenticated user access sensitive CI/CD variable values from debug-mode job traces because of missing authorization checks.

GitLab administrators should upgrade self-managed CE and EE deployments to version 19.4.1, 19.3.3, or 19.2.7 as soon as possible. The updates include database migrations, so single-node deployments should plan for downtime while migrations finish. Multi-node installations may use GitLab’s zero-downtime upgrade process where appropriate.

Security teams should also review recent CI/CD configuration changes, especially newly added or modified regular expressions in .gitlab-ci.yml files.

Reviewing GitLab audit events, administrator activity, unusual runner behavior, unexpected pipeline changes, and access to CI/CD variables can help identify possible misuse before or after patching.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC