EUVD-2026-85736
GHSA-9chr-4x58-948m
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Network-reachable but authenticated CI/CD write (PR:L); double-free-to-RCE under 'certain conditions' warrants AC:H; server code exec crosses context (S:C) with high C/I and limited A.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
3DescriptionCVE.org
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a specially crafted regular expression in a CI/CD configuration.
Articles & Coverage 1
AnalysisAI
Authenticated users who can define or modify a CI/CD configuration can achieve remote code execution on GitLab CE/EE servers by submitting a specially crafted regular expression that triggers a double free during server-side parsing. All versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 are affected; the vendor scores the issue 9.9, while our assessment retains full confidentiality and integrity impact but raises attack complexity to high because the vulnerable path is state-dependent and double-free corruption is inherently unreliable to exploit. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated GitLab account (PR:L) with sufficient permission to define or modify a CI/CD configuration - in practice at least Developer role on a project, or the ability to create a project on instances permitting self-registration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high priority, not a paper-tiger high-CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to GitLab 19.2.7, 19.3.3, or 19.4.1 (or later) as documented at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/, treating this as an out-of-band priority update given the RCE impact and the existence of publicly available exploit code. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm which GitLab instances are running releases in the 19.2.x, 19.3.x, or 19.4.x lines below 19.2.7, 19.3.3, and 19.4.1, inventory every account and group with rights to create or edit CI/CD configuration, and treat those accounts as privileged; where immediate upgrade is not possible, tighten CI/CD configuration permissions to the smallest possible set of trusted administrators and increase monitoring of pipeline config changes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
Unauthenticated arbitrary file read in GitLab CE/EE lets remote attackers retrieve files from the GitLab server via the
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
Sensitive credential and configuration disclosure in GitLab Enterprise Edition allows an authenticated user with Duo Cha
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Authenticated code execution on the GitLab server is possible in GitLab CE/EE 19.2 through 19.4.0, where an integer over
Unauthenticated path traversal in the @zereight/mcp-gitlab Model Context Protocol server prior to version 2.1.27 allows
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. Rated critical severity (CVSS 9.8)
Same weakness CWE-415 – Double Free
View allShare
External POC / Exploit Code
Leaving vuln.today