GitLab has patched a maximum-severity vulnerability that could let an unauthenticated attacker execute arbitrary code on servers running affected Community Edition (CE) or Enterprise Edition (EE) releases.
The flaw, tracked as CVE-2026-97229, affects GitLab 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. Operators should upgrade to the corresponding fixed release for their branch.
According to The Hacker News’ account of the GitLab advisory, exploitation is possible “under certain conditions” through a specially crafted regular expression in a CI/CD configuration. GitLab attributed the issue to inadequate validation of regular expressions.
CVE-2026-97229 reaches the maximum CVSS score
The NVD record classifies CVE-2026-97229 as CWE-190 and assigns it a CVSS 3.1 score of 10.0:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
That vector describes a network-reachable, low-complexity attack requiring neither authentication nor user interaction. The assessed effects on confidentiality, integrity, and availability are all high, with the compromise crossing a security boundary.
The affected and corrected versions are:
| Release branch | Affected versions | Fixed version |
|---|---|---|
| 19.2 | 19.2 before 19.2.8 | 19.2.8 |
| 19.3 | 19.3 before 19.3.5 | 19.3.5 |
| 19.4 | 19.4 before 19.4.2 | 19.4.2 |
The available description does not expand on the conditions required beyond the malicious CI/CD regular expression. The practical consequence, however, is direct: successful exploitation could give an unauthenticated party the ability to run commands on the GitLab server.
Three additional vulnerabilities fixed in the same releases
GitLab’s updates also address three high-severity weaknesses affecting repositories, protected branches, and CI/CD data.
-
CVE-2026-92883, CVSS 8.7, is a cross-site scripting vulnerability classified as CWE-79. A specially crafted repository could allow an authenticated user to execute JavaScript in another user’s browser session because HTML attributes in syntax-highlighted output were not adequately sanitized. It affects versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.
-
CVE-2026-16301, CVSS 8.5, concerns improper authorization checks in the downstream pipeline creation service. Under certain conditions, a user holding the Developer role could run CI/CD pipelines on protected branches without authorization. It affects versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.
-
CVE-2026-14814, CVSS 8.2, results from inadequate validation of repository references. It could let a user poison cached responses for raw repository files, causing targeted users’ pipelines to process crafted content and potentially expose protected environment variables. The affected ranges are all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.
All three are corrected by the same branch-specific releases as CVE-2026-97229: 19.2.8, 19.3.5, and 19.4.2.
Earlier GitLab file-read flaw is in CISA’s KEV catalog
The new patches follow another maximum-severity GitLab issue, CVE-2026-85706. That vulnerability could allow an unauthenticated user to read arbitrary files through the repository commits API because of improper path confinement and missing authentication enforcement.
Its CVSS 3.1 score is 10.0, with the vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CISA added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog on 2026-09-11. The remediation deadline for US federal civilian agencies was 2026-09-14. CISA directed agencies to apply vendor mitigations while following BOD 26-04 and its Forensics Triage Requirements; for cloud services, agencies must follow the applicable BOD 26-04 guidance or discontinue using the product if mitigations are unavailable.
The NVD description lists these affected and fixed branches:
- 18.7 before 18.11.12 — update to 18.11.12
- 19.0 before 19.0.9 — update to 19.0.9
- 19.1 before 19.1.8 — update to 19.1.8
- 19.2 before 19.2.6 — update to 19.2.6
- 19.3 before 19.3.2 — update to 19.3.2
NVD’s configuration data is narrower, listing only GitLab versions below 18.11.12, while its written description includes the additional 19.x branches above. Administrators should use the branch-specific corrected versions in the description rather than treating the narrower configuration entry as the complete affected range.
The Hacker News reported that probes for CVE-2026-85706 appeared within hours of its public disclosure, although its report did not identify the source of that observation. Inclusion in KEV separately establishes that CISA treats the vulnerability as exploited in the wild.
GitLab AI Gateway also received a command-execution fix
A separate vulnerability in the GitLab AI Gateway, CVE-2026-90970, carries a CVSS 3.1 score of 9.9.
An authenticated user with Duo Agent Platform access could use a crafted flow configuration to escape the prompt-template sandbox and execute arbitrary commands on the AI Gateway. NVD classifies the issue as CWE-1336 and records this vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
It affects AI Gateway versions from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1. The corresponding corrected releases are 19.2.4, 19.3.2, and 19.4.1.
GitLab CE and EE operators on the affected 19.2, 19.3, or 19.4 branches should prioritize the latest fixes—19.2.8, 19.3.5, or 19.4.2—to address CVE-2026-97229 and the three accompanying vulnerabilities. AI Gateway deployments require the separate branch-specific upgrades listed above.
