# CVE-2026-89078

Authenticated RCE in GitLab CI via crafted regex (double-free).

- Page: https://www.vulneraibility.com/cve/CVE-2026-89078
- CVSS: 9.9
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.52% (percentile 44.6)
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-09-24)
- Weakness: CWE-415
- Published: 2026-09-23

## Affected versions

- GitLab: affected >= 19.2 and < 19.2.7; >= 19.3 and < 19.3.3; >= 19.4 and < 19.4.1

A version outside these ranges is not a statement that it is unaffected.

## Impact

Authenticated user can execute arbitrary code on GitLab server via a specially crafted CI regex double-free, risking full server compromise and pipeline/artifact theft.

## Action

Immediate action required

## Recommendation

Apply vendor patches immediately; audit CI configs, tokens, runners and logs.

## References

- [other] https://gitlab.com/gitlab-org/gitlab/-/work_items/628577
- [exploit] https://hackerone.com/reports/4019059
- [other] https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/
- [other] https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.