{
    "file_item": {
        "filepath": "security-advisories",
        "filename": "CERT-EU-SA2026-016.pdf"
    },
    "title": "Critical Vulnerability in GitLab CE and EE",
    "serial_number": "2026-016",
    "publish_date": "12-10-2026 12:57:02",
    "description": "On 12 October 2026, GitLab released versions 19.4.2, 19.3.4 and 19.2.8 of GitLab Community Edition (CE) and Enterprise Edition (EE), fixing 24 security issues among which a critical vulnerability that could allow an unauthenticated attacker to execute arbitrary code on the server.<br>\nCERT-EU strongly recommends upgrading self-managed GitLab CE/EE instances to a fixed version as soon as possible, starting with internet-facing instances.<br>\n",
    "url_title": "2026-016",
    "content_markdown": "---\ntitle: 'Critical Vulnerability in\u00a0GitLab\u00a0CE\u00a0and\u00a0EE'\nnumber: '2026-016'\nversion: '1.0'\noriginal_date: '2026-10-12'\ndate: '2026-10-12'\n---\n\n_History:_\n\n* _12/10/2026 --- v1.0 -- Initial publication_\n\n# Summary\n\nOn 12 October 2026, GitLab released versions 19.4.2, 19.3.4 and 19.2.8 of GitLab Community Edition (CE) and Enterprise Edition (EE), fixing 24 security issues among which a **critical vulnerability** that could allow an **unauthenticated attacker** to **execute arbitrary code** on the server [1].\n\nCERT-EU strongly recommends upgrading self-managed GitLab CE/EE instances to a fixed version as soon as possible, starting with internet-facing instances.\n\n# Technical Details\n\nThe vulnerability **CVE-2026-97229**, with a CVSS score of 10.0, is located in the CI/CD regular expression compiler [1]. Weak validation of regular expressions leads to an **integer overflow**, and a specially crafted expression in a CI/CD configuration can then **trigger code execution** [1].\n\nThe same release also fixes other vulnerabilities [1]:\n\n- **CVE-2026-92883** (CVSS: 8.7): a **cross-site scripting** flaw in syntax highlighting that lets an **authenticated user run arbitrary JavaScript in other users' browsers** through a crafted repository [1].\n- **CVE-2026-16301** (CVSS: 8.5): an **authorisation flaw** that lets **a developer run pipelines on protected branches without permission** [1].\n- 21 further issues, including a cache poisoning bug rated 8.2 that could expose protected CI/CD variables [1].\n\n# Affected Products\n\nThe vulnerabilities affect the following versions of self-managed **GitLab CE/EE** instances [1]:\n\n- before 19.4.2\n- before 19.3.4\n- before 19.2.8\n\n# Recommendations\n\nCERT-EU strongly recommends upgrading all self-managed GitLab CE/EE instances to a fixed version, starting with internet-facing instances [1].\n\n# References\n\n[1] <https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/>\n",
    "content_html": "<p><em>History:</em></p><ul><li><em>12/10/2026 --- v1.0 -- Initial publication</em></li></ul><h2 id=\"summary\">Summary</h2><p>On 12 October 2026, GitLab released versions 19.4.2, 19.3.4 and 19.2.8 of GitLab Community Edition (CE) and Enterprise Edition (EE), fixing 24 security issues among which a <strong>critical vulnerability</strong> that could allow an <strong>unauthenticated attacker</strong> to <strong>execute arbitrary code</strong> on the server [1].</p><p>CERT-EU strongly recommends upgrading self-managed GitLab CE/EE instances to a fixed version as soon as possible, starting with internet-facing instances.</p><h2 id=\"technical-details\">Technical Details</h2><p>The vulnerability <strong>CVE-2026-97229</strong>, with a CVSS score of 10.0, is located in the CI/CD regular expression compiler [1]. Weak validation of regular expressions leads to an <strong>integer overflow</strong>, and a specially crafted expression in a CI/CD configuration can then <strong>trigger code execution</strong> [1].</p><p>The same release also fixes other vulnerabilities [1]:</p><ul><li><strong>CVE-2026-92883</strong> (CVSS: 8.7): a <strong>cross-site scripting</strong> flaw in syntax highlighting that lets an <strong>authenticated user run arbitrary JavaScript in other users' browsers</strong> through a crafted repository [1].</li><li><strong>CVE-2026-16301</strong> (CVSS: 8.5): an <strong>authorisation flaw</strong> that lets <strong>a developer run pipelines on protected branches without permission</strong> [1].</li><li>21 further issues, including a cache poisoning bug rated 8.2 that could expose protected CI/CD variables [1].</li></ul><h2 id=\"affected-products\">Affected Products</h2><p>The vulnerabilities affect the following versions of self-managed <strong>GitLab CE/EE</strong> instances [1]:</p><ul><li>before 19.4.2</li><li>before 19.3.4</li><li>before 19.2.8</li></ul><h2 id=\"recommendations\">Recommendations</h2><p>CERT-EU strongly recommends upgrading all self-managed GitLab CE/EE instances to a fixed version, starting with internet-facing instances [1].</p><h2 id=\"references\">References</h2><p>[1] <a rel=\"noopener\" target=\"_blank\" href=\"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/\">https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/</a></p>",
    "licence": {
        "title": "Creative Commons Attribution 4.0 International (CC-BY 4.0)",
        "link": "https://creativecommons.org/licenses/by/4.0/",
        "restrictions": "https://cert.europa.eu/legal-notice",
        "author": "The Cybersecurity Service for the Union institutions, bodies, offices and agencies"
    }
}