CVE-2026-93577 is an integer overflow vulnerability in GitLab Community and Enterprise Editions affecting versions from 19.2 prior to 19.2.7, 19.3 prior to 19.3.3, and 19.4 prior to 19.4.1. Under certain conditions, an authenticated user could exploit this flaw by submitting a specially crafted regular expression in a CI/CD configuration, leading to arbitrary code execution on the GitLab server. The vulnerability has a CVSS 3.1 score of 9.9, indicating critical severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows an authenticated user to execute arbitrary code on the GitLab server, potentially compromising confidentiality, integrity, and availability of the system. This could lead to full system compromise given the high CVSS score and the nature of the vulnerability.

GitLab has released official patches fixing this vulnerability in versions 19.2.7, 19.3.3, and 19.4.1. Users should upgrade to these versions or later to remediate the issue. No additional mitigations are indicated by the vendor advisory.