Remote Code Execution Vulnerability in GitLab Enterprise Edition
CVE-2026-88765

8.5HIGH

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
15 September 2026

What is CVE-2026-88765?

A vulnerability in GitLab Enterprise Edition allows authenticated users to exploit a Unicode conversion buffer overflow during the import of a specially crafted Git project export. This flaw affects various versions and can lead to unauthorized remote code execution, posing a significant security risk in environments where project imports are commonplace. GitLab has issued a remediation, highlighting the importance of updating to protected versions.

Affected Version(s)

GitLab 12.3 < 19.1.8

GitLab 19.2 < 19.2.6

GitLab 19.3 < 19.3.2

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/627435
https://hackerone.com/reports/3990469
technical-descriptionexploitpermissions-required

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program
.