GitLab fixes CVSS 10 code execution flaw in CE and EE
GitLab has patched a maximum-severity vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) that could have allowed unauthenticated users to run arbitrary code on a GitLab server under certain conditions.
The issue is tracked as CVE-2026-97229 and has a CVSS score of 10.0, the highest rating on the Common Vulnerability Scoring System, which is used to describe the severity of security flaws. GitLab said in a Monday advisory that the problem involved insufficient checking of a regular expression, a pattern used by software to match text, in a CI/CD configuration. CI/CD means continuous integration and continuous delivery, the automated process many development teams use to test, build and deploy software.
According to GitLab, a specially prepared regular expression in that CI/CD configuration could, in certain circumstances, lead to arbitrary code execution on the GitLab server. In practical terms, arbitrary code execution means an attacker may be able to make the affected system run commands or software chosen by the attacker. The advisory describes CVE-2026-97229 as an integer overflow issue, a type of bug that can happen when software mishandles a number that is too large for the space allocated to it.
The affected GitLab CE and EE versions are all versions from 19.2 before 19.2.8, all versions from 19.3 before 19.3.5, and all versions from 19.4 before 19.4.2. Fixed releases are available as 19.4.2, 19.3.5 and 19.2.8. Organisations running their own GitLab instance should check which version is installed and move to the matching fixed release without delay, especially where GitLab is reachable by users outside a tightly controlled internal network.
The same update also addresses three high-severity vulnerabilities. CVE-2026-92883, with a CVSS score of 8.7, is a cross-site scripting flaw. Cross-site scripting is a web security problem where a site can be made to run unwanted JavaScript, the scripting language used in browsers, in another user's session. GitLab said this issue could allow an authenticated user to execute JavaScript in other users' browser sessions through a specially crafted repository.
CVE-2026-16301, with a CVSS score of 8.5, is an improper authorization issue in the downstream pipeline creation service. Authorization is the decision about what an already signed-in user is allowed to do. In this case, GitLab said an authenticated user with the Developer role could execute CI/CD pipelines on protected branches. Protected branches are commonly used to restrict changes to important parts of a codebase, so a flaw affecting those protections is relevant to teams that rely on GitLab to control software releases.
The third high-severity bug is CVE-2026-14814, with a CVSS score of 8.2. GitLab described it as a permissive regular expression vulnerability that could allow a user to poison cached responses for raw repository files. A cache is stored data used to speed up later requests. GitLab said the issue could cause targeted users' CI/CD pipelines to run specially crafted content and could potentially expose protected environment variables. Environment variables are settings used by software, and protected ones may contain sensitive deployment or service information.
The advisory follows other recent GitLab security fixes mentioned by The Hacker News. GitLab previously fixed CVE-2026-90970, a critical AI Gateway vulnerability with a CVSS score of 9.9. That issue could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox through a specially crafted flow configuration and achieve arbitrary command execution on the AI Gateway. The Hacker News also reported that CVE-2026-85706, another maximum-severity GitLab CE and EE flaw with a CVSS score of 10.0, saw probes in the wild within hours of public disclosure last month.
For website owners and IT teams, the immediate concern is not only the GitLab server itself, but also the software delivery chain around it. A self-hosted GitLab system may hold source code, deployment settings and CI/CD workflows connected to websites, applications and infrastructure. A vulnerability that affects CI/CD configuration, protected branches, repository content or environment variables can therefore matter far beyond the code-hosting interface.
Administrators should treat this as a priority maintenance window, confirm the installed GitLab CE or EE version, and upgrade to 19.4.2, 19.3.5 or 19.2.8 as appropriate. Teams should also review which users have Developer role access, where protected branches are used, and whether CI/CD variables are limited to the jobs and branches that genuinely need them. These reviews do not replace patching, but they can reduce avoidable exposure around the same workflows.
For organisations that run code platforms as part of their web operations, AEU-I is relevant here because it provides security-first IT, infrastructure and consulting.
The key action is straightforward: affected GitLab CE and EE installations should be updated to a fixed release. The most severe flaw requires no authenticated account under the conditions described by GitLab, and the related high-severity bugs affect authenticated workflows that many development teams use every day.