Loading vulnerability…
Authenticated Remote Code Execution in GitLab EE Advanced Search Unicode Conversion
CVE-2026-88765 is a buffer overflow vulnerability in the Unicode conversion wrapper used by GitLab Enterprise Edition Advanced Search indexing. An authenticated attacker can import a specially crafted Git project export that triggers the overflow during indexing, potentially enabling remote code execution on the server. Affected versions begin at 12.3 and include the 19.1 release line, 19.2 versions before 19.2.6, and 19.3 versions before 19.3.2. The affected status of 19.1.8 is inconsistently documented. The vulnerability is rated High with a CVSS score of 8.5.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can permit arbitrary code execution on the affected GitLab EE server, with potentially high impacts on confidentiality, integrity, and availability. Attacker-controlled code could access or modify data and disrupt services within the privileges available to the compromised process. Root-level execution is not established.
If you can’t patch tonight, do this now.
Until patching is complete, restrict Git project-export imports to trusted administrators and users. Restrict network access to the affected instance and limit access to Advanced Search functionality where operationally feasible. These controls reduce exposure but do not replace the security update.
Patch, then assume compromise.
Upgrade self-managed GitLab EE to an applicable fixed release. Versions 19.2.6 and 19.3.2 are identified as fixed for their respective release lines. Version 19.1.8 is also identified as a fixed release, but conflicts with an affected-version range that includes it; confirm its status against authoritative vendor guidance before relying on that version. Follow GitLab's required upgrade path. These updates include database migrations, requiring planned downtime for single-node deployments; appropriately configured multi-node deployments can follow GitLab's zero-downtime upgrade procedure.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.