Do Son 
TL;DR
On September 23, 2026, developers launched a GitLab critical patch release fixing 11 security flaws. The most dangerous defects allow authenticated users to trigger a GitLab RCE vulnerability through malformed regular expressions. Administrators running self-managed instances must install version 19.4.1, 19.3.3, or 19.2.7 immediately.
- Total: 2 CVEs
- Severity: 2 Critical
- Actively exploited: None confirmed
- Highest severity: 9.9 (Critical · CVSSv3) — CVE-2026-89078
- Action: Apply the latest security updates now
Track every GitLab CVE the moment it's exploited.
Get free email alertsNotable CVEs
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-89078 | 9.9 | CWE-415 | 19.2.7, 19.3.3, 19.4.1 | Not exploited |
| CVE-2026-93577 | 9.9 | CWE-190 | 19.2.7, 19.3.3, 19.4.1 | Not exploited |
Why It Matters
Market estimates show that millions of developers utilize GitLab to host proprietary source code. The two primary vulnerabilities carry severe CVSS 9.9 scores. A successful breach grants an attacker arbitrary code execution capabilities on the host server. Furthermore, the update resolves a high-severity cross-site scripting flaw tracked as CVE-2026-84739. The vendor confirmed these flaws privately through the HackerOne bug bounty program. Currently, no active exploitation in the wild or public proof-of-concept exploit code has been confirmed. However, the security advisory stated, “we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately.”
How The Attack Works
The twin remote code execution flaws exist within the regular expression processing engine. An authenticated attacker exploits the GitLab RCE vulnerability by injecting a malicious regular expression into a CI/CD configuration. When the server parses the expression, it triggers either a double-free memory corruption or an integer overflow. The vendor warned that the defect “could have allowed an authenticated user to execute arbitrary code on the GitLab server.” Additionally, the cross-site scripting defect allows attackers to run unauthorized JavaScript. This occurs due to improper sanitization of path components inside the merge request diff viewer.
Affected Versions
The vulnerabilities affect multiple GitLab Community Edition (CE) and Enterprise Edition (EE) branches. Specifically, the flaws impact all versions from 19.2 prior to 19.2.7, 19.3 prior to 19.3.3, and 19.4 prior to 19.4.1.
Patch Or Mitigation Steps
System administrators must apply the GitLab critical patch release immediately. Administrators can protect their infrastructure by updating instances to version 19.4.1, 19.3.3, or 19.2.7. GitLab Dedicated deployments and GitLab.com users do not require manual intervention because the vendor applied the updates automatically. For multi-node environments, operators can execute zero-downtime procedures to maintain continuous availability.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
