CVE-2026-93577

Summary

The flaw is an integer overflow issue in GitLab's CI/CD configuration handling, allowing an authenticated user to execute arbitrary code. This is critical as it can lead to full server compromise.

Exploitability

Exploitation is moderately hard, requiring an authenticated user and a specially crafted regular expression. Precondition is access to the GitLab instance.

Blast radius

If exploited, the attacker could gain full control over the GitLab server, leading to data loss, service disruption, and potential lateral movement within the network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to GitLab CE/EE 19.2.7 or later, 19.3.3 or later, or 19.4.1 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.