Vulnerability in GitLab

[ Why it matters ]Priority signals

• Critical severity: CVSS 9.9

[ Description ]Official description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a specially crafted regular expression in a CI/CD configuration.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• CERT-FR24 Sep 2026CERTFR-2026-AVI-1225

  Multiple vulnerabilities in GitLab Translated from French

  Multiple vulnerabilities have been discovered in GitLab. Some of them allow an attacker to cause arbitrary code execution, a breach of data confidentiality and remote cross-site scripting (XSS).

  CVE-2026-92529CVE-2026-84739CVE-2026-4523+8 more CVEs
• BSI CERT-Bund23 Sep 2026WID-SEC-2026-3556

  GitLab: Multiple vulnerabilities Translated from German

  CVE-2026-8937CVE-2026-93577CVE-2026-92874+8 more CVEs

[ References ]References

• docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-releasedRelease NotesVendor Advisory
• gitlab.com/gitlab-org/gitlab/-/work_items/628577Issue Tracking
• hackerone.com/reports/4019059Permissions Required