This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] GitLab fixes 11 vulnerabilities
GitLab versions 19.2.7, 19.3.3 and 19.4.1 fix 11 vulnerabilities in GitLab CE/EE [1]. The most severe of them are listed below.
An authenticated remote attacker can, under certain conditions, execute arbitrary code when a specially crafted regular expression in the CI/CD configuration is processed [1].
The vulnerability is present in product:
- GitLab; >=19.2, <19.2.7; >=19.3, <19.3.3; >=19.4, <19.4.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
More information:
- CVE-2026-89078 at cve.org, NVD
- CWE-415: Double Free at cwe.mitre.org
The vulnerability was publicly disclosed 23. 9. 2026.
An authenticated remote attacker can, under certain conditions, execute arbitrary code when a specially crafted regular expression in the CI/CD configuration is compiled [1].
The vulnerability is present in product:
- GitLab; >=19.2, <19.2.7; >=19.3, <19.3.3; >=19.4, <19.4.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2026-93577 at cve.org, NVD
- CWE-190: Integer Overflow or Wraparound at cwe.mitre.org
The vulnerability was publicly disclosed 23. 9. 2026.
An authenticated remote attacker can, under certain conditions, carry out an XSS attack via the diff viewer [1].
The vulnerability is present in product:
- GitLab; >=13.11, <19.2.7; >=19.3, <19.3.3; >=19.4, <19.4.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2026-84739 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 23. 9. 2026.
By CESNET, z.s.p.o. Ondrej Pavlovič on 24. 9. 2026.