Critical GitLab Bugs Let Attackers Execute Code Through Malicious CI/CD Regex
GitLab patched two CVSS 9.9 flaws letting authenticated users execute code via malicious CI/CD regular expressions.
GitLab released emergency patches for two critical flaws, CVE-2026-89078 and CVE-2026-93577, both scored CVSS 9.9. An authenticated user can place a crafted regular expression in a CI/CD configuration to trigger a double-free or an integer overflow and potentially execute code on the GitLab server. Affected releases are GitLab CE and EE 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1. The update also fixes high-severity XSS CVE-2026-84739 and authorization flaw CVE-2026-92470 in GitLab Duo AI job troubleshooting.
- CVE-2026-89078 is a double-free in GitLab’s regex parser, rated CVSS 9.9.
- CVE-2026-93577 is an integer overflow in the regex compiler, also CVSS 9.9.
- Authenticated users can target self-managed GitLab CE and EE via CI/CD regex.
- Fixed in 19.4.1, 19.3.3, and 19.2.7; GitLab.com is already patched.
- Release also fixes XSS CVE-2026-84739 and Duo authorization flaw CVE-2026-92470.
- Vendors
- GitLab
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-84739 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain… | 8.7 | — | ||
CVE-2026-89078+2 related CVEs | Authenticated RCE in GitLab CE/EE via Double Free in CI/CD Regex Parsing | 9.9 group max | — |
From the original article
3 min read at cybersecuritynews.com
GitLab has released emergency security updates to fix two critical vulnerabilities that could allow authenticated attackers to execute arbitrary code on vulnerable GitLab servers through specially crafted regular expressions in CI/CD configurations. The flaws, tracked as CVE-2026-89078 and CVE-2026-93577, affect GitLab Community Edition and Enterprise Edition installations. GitLab issued patched releases 19.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.