CVE-2026-93577

Published: Sep 24, 2026Modified: Sep 28, 2026

9.9

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.1 / Impact: 6.0

Source: cve@gitlab.com (Secondary)

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration.

Affected (6)

Products: Gitlab: Gitlab

Gitlab

1 product

Gitlab

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	19.2.0 ≤ version < 19.2.7
Gitlab Gitlab	19.3.0 ≤ version < 19.3.3
Gitlab Gitlab	19.2.0 ≤ version < 19.2.7
Gitlab Gitlab	19.3.0 ≤ version < 19.3.3
Gitlab Gitlab	Version 19.4.0
Gitlab Gitlab	Version 19.4.0

Related CWEs

CWE-190

Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

References (3)

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/

Source: cve@gitlab.com

Release NotesVendor Advisory

https://gitlab.com/gitlab-org/gitlab/-/work_items/629758

Source: cve@gitlab.com

Issue Tracking

https://hackerone.com/reports/3995696

Source: cve@gitlab.com

Permissions Required

Timeline

No history available yet.