GITLAB has patched a critical vulnerability tracked as CVE-2026-97229 with a CVSS v3 score of 10.0, which could allow unauthenticated attackers to run arbitrary code on GitLab servers. The flaw stems from weak validation of regular expressions in CI/CD configurations, an integer overflow bug that could be exploited without logging in. The issue affects both Community Edition (CE) and Enterprise Edition (EE) and is present in GitLab versions 19.2 prior to 19.2.8, 19.3 prior to 19.3.5, and 19.4 prior to 19.4.2.
Users are advised to upgrade to the patched releases as soon as possible. GitLab’s advisory notes that the problem arose from insufficient regular expression validation in CI/CD configurations, which could enable an unauthenticated user to execute arbitrary code on the GitLab server.
In addition to CVE-2026-97229, the vendor fixed related flaws disclosed in the same advisory: CVE-2026-92883 (CVSS 8.7), enabling an attacker to induce a user’s browser to run malicious JavaScript via a specially crafted repository; CVE-2026-16301 (CVSS 8.5), an authorization bypass that could let a Developer-role user run CI/CD pipelines on protected code branches; and CVE-2026-14814 (CVSS 8.2), a pattern-matching flaw allowing manipulation of cached files to run malicious code and potentially leak environment variables.
The company also notes prior patches for CVE-2026-90970 in its AI Gateway, released in versions 19.2.4, 19.3.2 and 19.4.1, linked to an authenticated flow configuration escape vulnerability. The vulnerability reports credit HackerOne researcher joaxcar for disclosure.