CVE-2026-88765
GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could allow an authenticated user to achieve remote code execution by importing a specially crafted Git project export to overflow the Unicode conversion buffer used in Advanced Search indexing.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.5
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
- EPSS probability
- 0.72%
- CWE
- CWE-77
- Published
- 2026-09-15
- Last modified
- 2026-09-16
Affected products
- GitLab GitLab
- GitLab GitLab
- GitLab GitLab
Weakness type
Related vulnerabilities
- CVE-2026-47670 — DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection
- CVE-2026-86152 — Tenda CP3 Kylin AutoAddWifi.cpp ThreadProc os command injection
- CVE-2026-82971 — QVidium Opera11 CGI Script net_tr.cgi command injection
- CVE-2026-72869 — Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCE
- CVE-2026-72736 — Dokploy: OS Command Injection in registry credential testing and Swarm cluster management → HOST RCE
- CVE-2026-72735 — Dokploy: Command injection in writeTraefikConfigRemote via shell interpolation of unescaped YAML in SSH remote execution
- CVE-2026-54680 — Logging operator has Fluentd configuration injection that allows remote code execution
- CVE-2026-28672 — Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder