GitLab has released security updates for its Community Edition and Enterprise Edition, closing eleven vulnerabilities in versions 19.4.1, 19.3.3, and 19.2.7. Operators of self-managed GitLab instances need to act. GitLab.com already runs a patched version, and GitLab Dedicated customers do not need to take any action.
Two Critical Flaws in CI/CD Configurations
Two vulnerabilities are rated critical: CVE-2026-89078 and CVE-2026-93577. In both cases, authenticated users can craft a malicious regular expression inside a CI/CD configuration file to execute arbitrary code on the GitLab server under specific conditions. The first flaw stems from a memory error during expression parsing, the second from an integer overflow during compilation. No active exploitation has been reported so far.
Additional High-Severity Issues
Two vulnerabilities carry a high severity rating. CVE-2026-84739 lets authenticated attackers run JavaScript in victims' browsers through an XSS flaw in the merge request diff view. CVE-2026-92470 affects the Enterprise Edition only: it exposes protected CI/CD variable values through the GitLab Duo AI job analysis feature.
The remaining seven vulnerabilities involve broken permission checks and unauthorized access to sensitive content. One of them can expose CI/CD job logs to unauthenticated users. Version 19.2.7 also includes several bug fixes.
What to Do
If you run a self-hosted GitLab instance, update to version 19.4.1, 19.3.3, or 19.2.7 as soon as possible. Security updates are available for both editions.