Executive brief
GitLab EE is a web-based DevOps platform used for source code management and collaboration. An authenticated attacker can trigger a buffer overflow by importing a malicious Git project export, achieving remote code execution on the affected server. This allows an attacker to compromise the entire GitLab instance and access sensitive source code and configuration data.
Technical details
The vulnerability is a buffer overflow in the Unicode conversion buffer used by Advanced Search indexing when importing Git project exports. An authenticated user can craft a specially formed Git project export file to overflow this buffer, leading to remote code execution. The attack requires valid GitLab credentials and project import permissions. The affected versions are GitLab EE 12.3 through 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. Patches are available in GitLab EE 19.1.9, 19.2.6, and 19.3.2 or later.
Affected products
- GitLab GitLab EE 12.3 to 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2
Timeline
- 2026-09-15: disclosed