Critical Vulnerability in GitLab CE and EE
History:
- 12/10/2026 --- v1.0 -- Initial publication
Summary
On 12 October 2026, GitLab released versions 19.4.2, 19.3.4 and 19.2.8 of GitLab Community Edition (CE) and Enterprise Edition (EE), fixing 24 security issues among which a critical vulnerability that could allow an unauthenticated attacker to execute arbitrary code on the server [1].
CERT-EU strongly recommends upgrading self-managed GitLab CE/EE instances to a fixed version as soon as possible, starting with internet-facing instances.
Technical Details
The vulnerability CVE-2026-97229, with a CVSS score of 10.0, is located in the CI/CD regular expression compiler [1]. Weak validation of regular expressions leads to an integer overflow, and a specially crafted expression in a CI/CD configuration can then trigger code execution [1].
The same release also fixes other vulnerabilities [1]:
- CVE-2026-92883 (CVSS: 8.7): a cross-site scripting flaw in syntax highlighting that lets an authenticated user run arbitrary JavaScript in other users' browsers through a crafted repository [1].
- CVE-2026-16301 (CVSS: 8.5): an authorisation flaw that lets a developer run pipelines on protected branches without permission [1].
- 21 further issues, including a cache poisoning bug rated 8.2 that could expose protected CI/CD variables [1].
Affected Products
The vulnerabilities affect the following versions of self-managed GitLab CE/EE instances [1]:
- before 19.4.2
- before 19.3.4
- before 19.2.8
Recommendations
CERT-EU strongly recommends upgrading all self-managed GitLab CE/EE instances to a fixed version, starting with internet-facing instances [1].
References
[1] https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/