CVE-2026-89078

CriticalCVSS 9.9/10Last modified Oct 31, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a specially crafted regular expression in a CI/CD configuration.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Weakness enumeration

CWE-415

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 19.2, < 19.2.7; >= 19.3, < 19.3.3; >= 19.4, < 19.4.1

References

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/work_items/628577Issue Tracking
https://hackerone.com/reports/4019059Permissions Required
https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/

Timeline

Published: Sep 24, 2026
Last modified: Oct 31, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-890799.8The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. CVE-2026-890807.5The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed CVE-2026-890816.1The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' p CVE-2026-890829.3HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code executio CVE-2026-890839.3HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code executio CVE-2026-890848.8HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code executio CVE-2026-890856.6A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer ca CVE-2026-890869.1In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and pro CVE-2026-890877.3The cstruct package before 6.3.0 for OCaml mishandles indexes.CVE-2026-890885.5A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By co CVE-2026-890896.5A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A lo CVE-2026-89094.3The WpMobi plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.0.3. This is due to miss