GitLab Fixes Critical CVSS 10.0 Vulnerability That Could Allow Remote Code Execution

Meta Title: GitLab CVE-2026-97229: Critical Remote Code Execution Flaw Fixed

Meta Description: GitLab patched CVE-2026-97229, a critical CVSS 10.0 vulnerability that could allow unauthenticated attackers to execute arbitrary code through malicious CI/CD configurations.

SEO Keywords: GitLab vulnerability, CVE-2026-97229, GitLab remote code execution, GitLab security update, CI/CD security, GitLab CE, GitLab EE, critical cybersecurity vulnerability

GitLab Releases Security Updates for Critical Vulnerability

GitLab has released security patches for a critical vulnerability affecting its Community Edition (CE) and Enterprise Edition (EE) software. The flaw, tracked as CVE-2026-97229, carries a maximum CVSS score of 10.0 out of 10 and could potentially allow unauthenticated attackers to execute arbitrary code on a GitLab server.

According to GitLab's security advisory, the issue stems from insufficient validation of regular expressions in CI/CD configurations. Under certain conditions, an attacker could exploit a specially crafted regular expression to trigger code execution on a vulnerable server.

The vulnerability has been described as an integer overflow issue, making it important for organizations running affected GitLab versions to apply the available updates.

CVE-2026-97229: A Critical CI/CD Security Flaw

The vulnerability affects GitLab's handling of regular expressions used in CI/CD configuration files. Improper validation under certain conditions could allow a specially crafted configuration to trigger unexpected behavior and potentially execute arbitrary code.

The most significant concern is that the reported attack scenario does not require authentication. If successfully exploited, the vulnerability could place the GitLab server and its connected development infrastructure at risk.

GitLab has addressed the issue in the following releases:

  • GitLab 19.2: Upgrade to version 19.2.8 or later.
  • GitLab 19.3: Upgrade to version 19.3.5 or later.
  • GitLab 19.4: Upgrade to version 19.4.2 or later.

Organizations should identify their deployed versions and upgrade to the appropriate patched release.

Three Additional High-Severity Vulnerabilities Fixed

Alongside CVE-2026-97229, GitLab addressed three additional high-severity security issues.

1. CVE-2026-92883: Cross-Site Scripting

CVSS Score: 8.7

This vulnerability could allow an authenticated user to execute arbitrary JavaScript in other users' browser sessions through a specially crafted repository.

Successful exploitation could expose users to malicious browser-side actions within the affected application context.

2. CVE-2026-16301: Improper Authorization in CI/CD Pipelines

CVSS Score: 8.5

An authorization flaw in the downstream pipeline creation service could allow an authenticated user with the Developer role to execute CI/CD pipelines on protected branches.

This could undermine branch protection controls and potentially enable unauthorized pipeline execution.

3. CVE-2026-14814: Regular Expression and Cache Poisoning Issue

CVSS Score: 8.2

This vulnerability involves a permissive regular expression that could allow an attacker to poison cached responses for raw repository files.

Targeted users' CI/CD pipelines could then execute specially crafted content, potentially exposing protected environment variables.

The issue highlights the importance of securing repository content, cache behavior, and pipeline execution workflows.

GitLab's Recent Security Vulnerability History

The latest disclosure follows other significant security issues affecting GitLab.

In October 2026, GitLab addressed a critical vulnerability in its self-hosted AI Gateway, tracked as CVE-2026-90970, with a CVSS score of 9.9. The issue could allow an authenticated user with Duo Agent Platform access to escape a prompt-template sandbox through a specially crafted flow configuration and execute arbitrary commands on the AI Gateway.

In September 2026, another maximum-severity vulnerability, CVE-2026-85706, affected GitLab CE and EE. Reports indicated that exploitation attempts were observed in the wild within hours of its public disclosure.

These incidents underline the importance of promptly applying security updates across source-code management platforms, CI/CD infrastructure, and related AI services.

Organizations using GitLab should take the following steps to reduce exposure:

  1. Upgrade immediately: Install the patched version corresponding to your current GitLab release branch.
  2. Inventory all deployments: Identify self-managed GitLab CE and EE instances running affected versions.
  3. Review CI/CD configurations: Inspect recent changes to pipeline configuration files and regular expressions.
  4. Audit protected branches: Verify branch protection settings and review who can trigger pipelines on protected branches.
  5. Inspect repository and cache behavior: Review suspicious changes involving raw repository files and cached responses.
  6. Protect sensitive variables: Limit access to CI/CD variables and use protected and masked variables where appropriate.
  7. Review logs: Investigate unexpected pipeline executions, suspicious repository changes, or unusual server activity.

Organizations should prioritize patching rather than relying solely on monitoring or configuration changes.

Key Takeaway

GitLab's CVE-2026-97229 highlights the security risks associated with insufficient input validation in CI/CD systems. With a reported CVSS score of 10.0 and a potential unauthenticated code-execution impact, the flaw deserves prompt attention from administrators of affected GitLab installations.

Applying the available patches, reviewing pipeline permissions, and protecting sensitive CI/CD variables can help organizations reduce the risk of compromise.

Official Security Advisory:

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/