securityonline.info 23 Sept 2026, 23:36 UTC

GitLab Fixes Critical CI/CD Flaws Enabling Arbitrary Code Execution

GitLab Fixes Critical CI/CD Flaws Enabling Arbitrary Code Execution
CyberSIXT Evidence Panel
CISA KEV Not in KEV
Patch Patch Available

GITLAB released a security update on 23 September 2026 addressing 11 flaws in its Community Edition (CE) and Enterprise Edition (EE) products. Two vulnerabilities, CVE-2026-89078 and CVE-2026-93577, are rated 9.9 (critical) on CVSSv3 and could allow an authenticated user to execute arbitrary code on a GitLab server. GitLab said the issues were reported privately through its HackerOne bug bounty programme. There is currently no confirmed exploitation in the wild or public proof-of-concept code.

The flaws affect versions before 19.2.7, 19.3.3 and 19.4.1 in their respective release branches. According to the report, an attacker could inject a malicious regular expression into a CI/CD configuration; processing it may trigger either double-free memory corruption or an integer overflow. The release also fixes CVE-2026-84739, a high-severity cross-site scripting flaw caused by insufficient sanitisation of path components in the merge request diff viewer.

GitLab recommends that administrators of self-managed installations upgrade immediately to version 19.2.7, 19.3.3 or 19.4.1. GitLab.com and GitLab Dedicated customers do not need to take manual action because those services were updated automatically.

View full article

Article by CyberSIXT