GitLab Patches Critical CVSS 10.0 Flaw in 19.4.2, 19.3.4 and 19.2.8 Releases

The critical flaw: code execution through CI/CD regular expressions

The most serious fix is for CVE-2026-97229, an integer overflow issue in the CI/CD regular expression compiler. According to GitLab, under certain conditions it could have allowed an unauthenticated user to execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration. The cause was insufficient regular expression validation.

The flaw carries a CVSS score of 10.0. It affects GitLab CE/EE versions from 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2. GitLab thanked the researcher joaxcar, who reported it through the company's HackerOne bug bounty program.

Five high-severity issues and many more fixes

The release table lists one critical, five high, fourteen medium and four low severity fixes. The high-severity items are:

• CVE-2026-92883: a cross-site scripting issue in syntax highlighting (CVSS 8.7) that could let an authenticated user run arbitrary JavaScript in other users' browser sessions via a crafted repository.
• CVE-2026-16301: an improper authorization issue in the downstream pipeline creation service (CVSS 8.5) that could let a user with the Developer role run CI/CD pipelines on protected branches without authorization.
• CVE-2026-14814: a permissive regular expression issue in repository file access (CVSS 8.2) that could allow poisoning of cached responses for raw repository files, potentially exposing protected environment variables.
• CVE-2026-81839: an incorrect authorization issue in the scheduled pipeline execution policy (CVSS 7.7), affecting GitLab EE only.
• CVE-2026-96893: an improper neutralization issue in GitLab Duo Agent Platform (CVSS 7.3), affecting GitLab EE only. GitLab says an authenticated user could inject crafted content into AI agent instructions, potentially causing unintended command execution attributed to other users. The company says its team member Mert Coskuner discovered it internally.

Medium-severity fixes cover areas such as GitLab Pages, the Kubernetes proxy, several GraphQL endpoints, the package registry, custom roles and a second Duo Agent Platform issue. The Pages flaw, CVE-2026-101168, could have let an authenticated user with access to log data obtain access tokens and other secrets.

Who needs to act, and a known issue

GitLab says GitLab.com is already running the patched version, and GitLab Dedicated customers do not need to take any action. Self-managed installations are the ones at risk and should move to one of the patched versions as soon as possible.

The company also lists a known issue: version 19.3.4 has a bug affecting merge request pages when the Ona integration is enabled. A fix is planned for 19.3.5.

GitLab notes that it publishes vulnerability fixes in patch releases, which are either scheduled, on the second and fourth Wednesdays of each month, or ad-hoc critical patches for high-severity vulnerabilities. Issues describing each security fix are made public on its issue tracker 90 days after the release that patched them.

What it means for administrators

Because the top-rated flaw requires no authentication and affects three current release lines, administrators of self-managed instances running 19.2, 19.3 or 19.4 have a clear upgrade path in 19.2.8, 19.3.4 or 19.4.2. Teams on 19.3 should weigh the Ona integration bug if they use that feature. Several of the other flaws affect older versions too, with some reaching back as far as 12.0 for the Pages issue. GitLab advises customers to stay on the latest patch release for their supported version.