GitLab has recently addressed multiple security vulnerabilities, including critical remote code execution (RCE) flaws, by releasing updates for its Community Edition (CE) and Enterprise Edition (EE). These vulnerabilities, if exploited, could allow attackers to execute arbitrary code on default GitLab installations, potentially exposing sensitive data and internal services.
Details of the Vulnerabilities
Among the vulnerabilities patched, three high-severity issues stand out:
- CVE-2026-10086: An XSS flaw in the Analytics dashboard of GitLab EE, stemming from improper sanitization of user-supplied input. This could have allowed authenticated users with developer rights to execute arbitrary client-side code in other users’ sessions.
- CVE-2026-10712: An XSS vulnerability in the Web IDE workbench asset handler, which could have enabled unauthenticated attackers to execute JavaScript code in users’ browser sessions.
- CVE-2026-12053: Insufficient output filtering in Duo Workflows, potentially allowing users to access sensitive information already committed to a project.
These vulnerabilities were identified through automated analysis, revealing memory-safety flaws in the Ruby JSON parsing library, Oj, utilized by GitLab. The flaws included an unchecked nesting-stack write and an unsafe 16-bit key-length narrowing that leaked a heap pointer. When combined, these issues could grant attackers full control over a callback pointer, ultimately leading to arbitrary code execution as the “git” system user.
Impact and Mitigation
Exploitation of these vulnerabilities could result in unauthorized access to repository source code, Rails application secrets, service credentials, and internal services accessible from the GitLab host. This poses significant risks, including data theft, code tampering, and potential lateral movement within networks.
GitLab has released patches to address these vulnerabilities in the following versions:
- GitLab CE/EE 18.10.8
- GitLab CE/EE 18.11.5
- GitLab CE/EE 19.0.2
Users of self-managed GitLab installations are strongly advised to upgrade to these versions immediately to mitigate potential risks. GitLab.com has already been updated to the patched versions, requiring no action from cloud service users.
These vulnerabilities underscore the importance of regular security assessments and prompt application of patches to maintain the integrity and security of software systems. Organizations should remain vigilant and proactive in addressing such issues to protect their assets and data.
