GitLab has released emergency patches for two critical remote code execution vulnerabilities that both scored 9.9 out of 10 on the CVSS severity scale. The company strongly urges all self-managed installations to upgrade immediately.
Both flaws target GitLab’s CI/CD configuration regex engine. As a result, any authenticated user with pipeline access can exploit them. The first vulnerability, CVE-2026-93577, triggers an integer overflow during regex compilation. This overflow then corrupts memory and allows arbitrary code execution on the server. The second flaw, CVE-2026-89078, exploits a double free bug in the regex parser to achieve the same outcome.
Security researcher “joaxcar” discovered both vulnerabilities through HackerOne’s bug bounty program. GitLab also confirmed that attackers need only low-level privileges to exploit either flaw. Furthermore, neither vulnerability requires any user interaction beyond the attacker’s own actions.
The attack vector is straightforward. An attacker simply submits a specially crafted regular expression inside a .gitlab-ci.yml file. The server then processes this malicious regex during pipeline parsing. Consequently, the attacker gains full code execution on the GitLab server. This access potentially exposes source code, CI/CD secrets, runner tokens, and environment variables.
GitLab released patched versions 19.4.1, 19.3.3, and 19.2.7 on September 23, 2026. The company has already patched GitLab.com directly. However, all self-managed CE and EE instances running versions 19.2 through 19.4 still need manual upgrades.
Beyond the two critical flaws, this patch also fixes nine additional vulnerabilities. These include a high-severity XSS bug in the merge request diff viewer (CVSS 8.7) and a missing authorization flaw in the Duo AI troubleshooting feature (CVSS 7.7). In total, GitLab addressed 11 security issues in this single release.
Until administrators can patch, GitLab recommends restricting CI/CD configuration permissions to trusted users only. Additionally, teams should review recent .gitlab-ci.yml changes for suspicious regex patterns and rotate all CI/CD variables and tokens as a precaution.
