GITLAB released a security update on 23 September 2026 addressing 11 flaws in its Community Edition (CE) and Enterprise Edition (EE) products. Two vulnerabilities, CVE-2026-89078 and CVE-2026-93577, are rated 9.9 (critical) on CVSSv3 and could allow an authenticated user to execute arbitrary code on a GitLab server. GitLab said the issues were reported privately through its HackerOne bug bounty programme. There is currently no confirmed exploitation in the wild or public proof-of-concept code.
The flaws affect versions before 19.2.7, 19.3.3 and 19.4.1 in their respective release branches. According to the report, an attacker could inject a malicious regular expression into a CI/CD configuration; processing it may trigger either double-free memory corruption or an integer overflow. The release also fixes CVE-2026-84739, a high-severity cross-site scripting flaw caused by insufficient sanitisation of path components in the merge request diff viewer.
GitLab recommends that administrators of self-managed installations upgrade immediately to version 19.2.7, 19.3.3 or 19.4.1. GitLab.com and GitLab Dedicated customers do not need to take manual action because those services were updated automatically.