GitLab releases fixes for CVSS 10.0 CI/CD code execution flaw
GitLab issues emergency fixes for maximum-severity vulnerability
GitLab has released security updates for CVE-2026-97229, a CVSS 10.0 vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). Under certain conditions, the flaw could allow an unauthenticated user to execute arbitrary code on a GitLab server through a specially crafted regular expression in a CI/CD configuration.
The company described the issue as an integer overflow caused by insufficient regular-expression validation. The affected release ranges are all GitLab versions from 19.2 before 19.2.8, from 19.3 before 19.3.5, and from 19.4 before 19.4.2.
GitLab has made fixes available in versions 19.2.8, 19.3.5 and 19.4.2. Organisations running self-managed CE or EE should determine which supported release line they use and move to the corresponding patched version.
Three high-severity issues fixed in the same release
The security update also addresses CVE-2026-92883, rated 8.7. This cross-site scripting vulnerability could enable an authenticated user to execute arbitrary JavaScript within other users' browser sessions by using a specially crafted repository.
GitLab also fixed CVE-2026-16301, with a CVSS score of 8.5. The improper-authorization issue in the downstream pipeline creation service could permit an authenticated user with the Developer role to run CI/CD pipelines on protected branches.
A third high-severity flaw, CVE-2026-14814, has a CVSS score of 8.2. GitLab said a permissive regular expression could allow a user to poison cached responses for raw repository files. Targeted users' CI/CD pipelines could then execute specially crafted content, potentially exposing protected environment variables.
Why CI/CD administrators should act promptly
The maximum score assigned to CVE-2026-97229 reflects the potential impact of arbitrary code execution on the GitLab server and the lack of an authentication requirement in the stated attack conditions. CI/CD platforms commonly hold source code, build definitions, pipeline credentials and links to deployment environments, making their patch status operationally significant.
The update follows GitLab's remediation of CVE-2026-90970, a CVSS 9.9 flaw in AI Gateway. GitLab said that issue could allow an authenticated user with Duo Agent Platform access to escape a prompt-template sandbox via a specially crafted flow configuration and achieve arbitrary command execution on AI Gateway.
GitLab also faced a separate CVSS 10.0 CE and EE vulnerability, CVE-2026-85706, for which probes were observed in the wild within hours of public disclosure. That context makes timely maintenance particularly important for exposed and self-managed installations.
Practical business implication
Security and platform teams should inventory GitLab CE and EE deployments, apply 19.2.8, 19.3.5 or 19.4.2 as appropriate, and ensure the update process includes CI/CD configurations and access to protected branches and environment variables.