GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result in arbitrary code execution.
“GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation,” the company said in a Monday advisory.
The flaw, tracked as CVE-2026-97229, has been described as an integer overflow issue. It carries a CVSS score of 10.0. It affects the following versions –
- All versions from 19.2 before 19.2.8
- All versions from 19.3 before 19.3.5, and
- All versions from 19.4 before 19.4.2
Patches for the flaw are available in versions 19.4.2, 19.3.5, and 19.2.8. Also addressed are three high-severity bugs –
- CVE-2026-92883 (CVSS score: 8.7) – A cross-site scripting vulnerability that could allow an authenticated user to execute arbitrary JavaScript in the context of other users’ browser sessions via a specially crafted repository.
- CVE-2026-16301 (CVSS score: 8.5) – An improper authorization vulnerability in the downstream pipeline creation service that could allow an authenticated user with Developer role to execute CI/CD pipelines on protected branches.
- CVE-2026-14814 (CVSS score: 8.2) – A permissive regular expression vulnerability that could allow a user to poison cached responses for raw repository files, causing targeted users’ CI/CD pipelines to execute specially crafted content and potentially exposing protected environment variables.
The disclosure comes weeks after it remediated a critical flaw in AI Gateway (CVE-2026-90970, CVSS score: 9.9) that could have allowed an authenticated user with Duo Agent Platform access to break out of the prompt template sandbox via a specially crafted flow configuration and achieve arbitrary command execution on the AI Gateway.
Last month, another maximum-severity security flaw in GitLab CE and EE (CVE-2026-85706, CVSS score: 10.0) witnessed in-the-wild probes within hours of public disclosure.
