GITLAB has issued patches for a critical vulnerability, CVE-2026-97229, that could let an unauthenticated attacker run arbitrary server code. GitLab described the flaw as an integer overflow arising from insufficient regular expression validation in a CI/CD configuration, which could be triggered by a specially crafted input. The issue affects both Community Edition (CE) and Enterprise Edition (EE) and carries a maximum CVSS score of 10.0. Patches are available in versions 19.4.2, 19.3.5, and 19.2.8, and users are advised to upgrade to one of those releases to remediate the flaw.
The report also notes three additional high-severity issues addressed in the same patch set: CVE-2026-92883 (CVSS 8.7) a cross-site scripting vulnerability that could allow an authenticated user to run arbitrary JavaScript in other users’ sessions; CVE-2026-16301 (CVSS 8.5) an improper authorization flaw in the downstream pipeline creation service that could enable a Developer to run CI/CD pipelines on protected branches; and CVE-2026-14814 (CVSS 8.2) a permissive regular expression vulnerability that could poison cached responses for raw repository files, potentially exposing protected environment variables.
The disclosure follows earlier GitLab remediations, including CVE-2026-90970 in AI Gateway (CVSS 9.9) and CVE-2026-85706 (CVSS 10.0) from the prior month. The article preserves the CVEs, scores and patched versions, and distinguishes confirmed exploitation from potential impact while outlining the practical response.