CVE-2026-93577

CRITICAL

INFO Priority: 0.06 BB Relevance: 70/100

Published: 2026-09-24 Modified: 2026-10-31 First seen: 2026-10-30 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact Scope Change

CVSS Vector Breakdown

AV: Network

AC: Low

PR: Low

UI: None

S: Changed

C: High

I: High

A: High

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration.

Weakness Classification (1)

CWE-190 — CWE-190: Integer Overflow or Wraparound

Affected Software (7)

Vendor	Product	Version
GitLab	GitLab	19.2 < 19.2.7
GitLab	GitLab	19.3 < 19.3.3
GitLab	GitLab	19.4 < 19.4.1
gitlab	gitlab	19.2.0 – 19.2.7
gitlab	gitlab	19.2.0 – 19.2.7
gitlab	gitlab	19.4.0
gitlab	gitlab	19.4.0