VDB
GCVE-110-NCSC-2026-414
GCVE-110-NCSC-2026-414
Advisory PublishedCVSS 2.7/10
GitLab versions prior to 19.2.8, 19.3.5, and 19.4.2 contained a vulnerability allowing unauthenticated users to execute arbitrary code via specially crafted regular expressions in CI/CD configurations due to insufficient input validation.
Weaknesses (CWE)
CWE-190Integer Overflow or WraparoundCWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-863Incorrect AuthorizationCWE-625Permissive Regular ExpressionCWE-1427Improper Neutralization of Input Used for LLM PromptingCWE-532Insertion of Sensitive Information into Log FileCWE-601URL Redirection to Untrusted Site ('Open Redirect')CWE-349Acceptance of Extraneous Untrusted Data With Trusted DataCWE-266Incorrect Privilege AssignmentCWE-1220Insufficient Granularity of Access ControlCWE-807Reliance on Untrusted Inputs in a Security DecisionCWE-918Server-Side Request Forgery (SSRF)
Risk Scores
CVSS 3.1
2.7/10
Low · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| GitLab | vers:unknown/* | — | — |
Aliases
CVE-2026-100104CVE-2026-100755CVE-2026-101168CVE-2026-103549CVE-2026-104661CVE-2026-105458CVE-2026-14210CVE-2026-14552CVE-2026-14814CVE-2026-16275CVE-2026-16301CVE-2026-5954CVE-2026-6567CVE-2026-7767CVE-2026-78335CVE-2026-81839CVE-2026-82632CVE-2026-84284CVE-2026-85529CVE-2026-92528CVE-2026-9268CVE-2026-92883CVE-2026-96893CVE-2026-97229
Browse GCVE Records
3,384 records in the GCVE database · Updated October 13, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.