CVE-2026-88765: GitLab EE Remote Code Execution Vulnerability

CVE-2026-88765 Overview

CVE-2026-88765 is a high-severity remote code execution vulnerability in GitLab Enterprise Edition (EE). The flaw resides in the Unicode conversion buffer used by Advanced Search indexing. An authenticated user can import a specially crafted Git project export to overflow this buffer and execute arbitrary code on the GitLab server. The vulnerability is classified under CWE-77: Improper Neutralization of Special Elements used in a Command. Successful exploitation compromises confidentiality, integrity, and availability of the affected instance and can pivot into hosted repositories and CI/CD pipelines.

Critical Impact
Authenticated attackers can achieve remote code execution on GitLab EE servers by importing a malicious Git project export, exposing source code, secrets, and downstream build systems.

Affected Products

GitLab Enterprise Edition (EE) all versions from 12.3 through 19.1.8
GitLab Enterprise Edition (EE) 19.2 before 19.2.6
GitLab Enterprise Edition (EE) 19.3 before 19.3.2

Discovery Timeline

2026-09-15 - CVE-2026-88765 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-88765

Vulnerability Analysis

The vulnerability affects the Advanced Search indexing pipeline in GitLab EE, which relies on Elasticsearch or OpenSearch to build searchable indexes of repository content. When a project is imported through a Git project export, GitLab parses repository contents and normalizes text into Unicode before writing entries into the search index. The conversion routine allocates a fixed-size buffer that fails to account for edge-case expansion during Unicode transformation.

An authenticated user with permission to import projects can craft an export archive containing repository data engineered to trigger buffer expansion beyond the allocated capacity. Overflowing this buffer corrupts adjacent memory in the indexer worker process and yields control flow suitable for remote code execution in the context of the GitLab application.

Root Cause

The root cause is missing bounds validation in the Unicode conversion buffer used by Advanced Search indexing. Character sets whose byte length grows after normalization exceed the pre-computed buffer size. The indexer writes past the allocation boundary, corrupting process memory. Because the issue is reachable through the import workflow, exploitation does not require administrative privileges.

Attack Vector

The attack is network-based and requires authentication to a GitLab EE instance with project import permissions. The attacker prepares a Git project export containing payloads that exercise the vulnerable Unicode conversion path during indexing. After import completes, Advanced Search processes the repository, triggering the overflow. Successful exploitation runs code with the privileges of the GitLab application process. Refer to GitLab Work Item 627435 and HackerOne Report #3990469 for the vendor-tracked technical context.

// No verified proof-of-concept code has been published for CVE-2026-88765.
// Exploitation requires a crafted Git project export that triggers Unicode
// buffer expansion during Advanced Search indexing on a GitLab EE instance.

Detection Methods for CVE-2026-88765

Indicators of Compromise

Unexpected project imports from newly created or low-reputation user accounts, especially imports containing unusually large or malformed text blobs.
Crashes, segmentation faults, or restarts of the GitLab indexer or Sidekiq workers correlated with Advanced Search indexing jobs.
New processes spawned by the GitLab application user (git, gitlab-rails) that are inconsistent with normal operation.
Outbound network connections from GitLab application servers to unfamiliar hosts following an import event.

Detection Strategies

Correlate project import events in GitLab audit logs with subsequent indexer errors, worker restarts, or memory faults on the same instance.
Monitor Elasticsearch or OpenSearch integration logs for indexing failures tied to specific project IDs and repeated retries.
Baseline expected child processes of the GitLab application user and alert on deviations such as shells, interpreters, or network utilities.

Monitoring Recommendations

Enable and centralize GitLab audit event streaming, including project_imported, project_export_downloaded, and Advanced Search reindex events.
Forward host telemetry from GitLab servers into a centralized analytics platform to correlate imports with process execution and outbound network activity.
Track Sidekiq queue health and Advanced Search indexer error rates as leading indicators of exploitation attempts.

How to Mitigate CVE-2026-88765

Immediate Actions Required

Upgrade GitLab EE to 19.1.9, 19.2.6, 19.3.2, or later as applicable to your deployment branch.
Restrict project import permissions to trusted users while patching is in progress, and audit accounts that recently imported projects.
Review Advanced Search indexer logs and Sidekiq worker logs for signs of crashes or anomalous behavior since the vulnerability publication date.

Patch Information

GitLab has remediated the issue in GitLab EE versions 19.1.9, 19.2.6, and 19.3.2. Administrators running any release from 12.3 up to the listed fixed versions must upgrade. Refer to GitLab Work Item 627435 for vendor tracking of the remediation.

Workarounds

Temporarily disable Advanced Search indexing until upgrading, which removes the vulnerable code path from processing imported repositories.
Disable project import functionality at the instance level, or restrict it to administrators, if immediate patching is not possible.
Enforce approval workflows for new user registrations to reduce the population of authenticated accounts able to trigger imports.

bash

# Example: disable Advanced Search indexing via the GitLab Rails console
# until patched versions are deployed
sudo gitlab-rails runner "ApplicationSetting.current.update!(elasticsearch_indexing: false, elasticsearch_search: false)"

# Example: restrict project imports at the instance level
# Admin Area > Settings > General > Import and export settings
# Disable all import sources until upgrade to 19.1.9 / 19.2.6 / 19.3.2 is complete