- GitLab patched a maximum-severity flaw (CVE-2026-97229, CVSS 10.0) that allows unauthenticated code execution via a crafted regular expression in CI/CD configurations.
- Three high-severity vulnerabilities were also fixed, including cross-site scripting (CVE-2026-92883), improper authorization (CVE-2026-16301), and a permissive regex issue (CVE-2026-14814) enabling cache poisoning.
- The patches arrive weeks after GitLab remediated a critical AI Gateway bug (CVE-2026-90970, CVSS 9.9) and a prior maximum-severity flaw (CVE-2026-85706) that saw in-the-wild probes within hours of disclosure.
GitLab has released urgent patches for a maximum-severity security flaw in its Community Edition (CE) and Enterprise Edition (EE) software that could lead to arbitrary code execution on affected servers. The company said the issue arises from insufficient regular expression validation, potentially allowing an unauthenticated attacker to execute code via a specially crafted regex in a CI/CD configuration.
Tracked as CVE-2026-97229 with a CVSS score of 10.0, the integer overflow vulnerability impacts all versions from 19.2 before 19.2.8, from 19.3 before 19.3.5, and from 19.4 before 19.4.2. GitLab addressed the flaw in versions 19.4.2, 19.3.5, and 19.2.8, alongside three high-severity bugs: a cross-site scripting bug (CVE-2026-92883, CVSS 8.7), an authorization flaw in pipeline creation (CVE-2026-16301, CVSS 8.5), and a permissive regex issue allowing cache poisoning (CVE-2026-14814, CVSS 8.2).
This disclosure follows GitLab‘s recent patch for a critical AI Gateway vulnerability (CVE-2026-90970, CVSS 9.9) that could have let authenticated users escape the prompt template sandbox and achieve command execution. Last month, another maximum-severity flaw (CVE-2026-85706, CVSS 10.0) witnessed active exploitation attempts within hours of public disclosure.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
