Critical GitLab Vulnerability Allows Unauthenticated Attackers to Execute Remote Code

GitLab has released emergency security updates to address a critical vulnerability that could allow unauthenticated attackers to execute arbitrary code on affected servers.

This vulnerability, tracked as CVE-2026-97229, has been assigned the highest CVSS score of 10.0 and impacts both GitLab Community Edition and Enterprise Edition.

On October 12, 2026, the company released versions 19.4.2, 19.3.5, and 19.2.8 and strongly urged self-managed customers to upgrade immediately.

The release addresses 24 vulnerabilities, including remote code execution, cross-site scripting, pipeline authorization bypasses, information disclosure, and AI prompt injection.

GitLab.com is already running the patched version, and GitLab Dedicated customers do not need to take any action.

Critical GitLab Vulnerability

The critical vulnerability lies within GitLab’s CI/CD regular expression compiler and has been classified as an integer overflow issue.

GitLab has indicated that insufficient validation of regular expressions could enable an unauthenticated user to execute arbitrary code on the GitLab server through a specially crafted regular expression embedded in a CI/CD configuration.

The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, which describes a network-based exploitation scenario with low attack complexity, no required privileges, and no user interaction.

The assessment shows scope changes and high impacts on confidentiality, integrity, and availability. GitLab has noted that the exploitation scenario can occur “under certain conditions,” but has not provided further details in the advisory.

GitLab credited security researcher joaxcar for reporting this vulnerability through its HackerOne bug bounty program. The advisory does not indicate any active exploitation or provide a public proof-of-concept exploit. GitLab states that detailed vulnerability issues will become public 90 days after the release containing their fixes.

Affected Versions and Additional Security Fixes

The critical flaw affects the following GitLab CE and EE branches:

• GitLab versions 19.2 earlier than 19.2.8.
• GitLab versions 19.3 earlier than 19.3.5.
• GitLab versions 19.4 earlier than 19.4.2.

The update also resolves CVE-2026-92883, an 8.7-severity cross-site scripting vulnerability related to improperly sanitized HTML attributes in syntax-highlighted output. An authenticated attacker could exploit this to execute JavaScript in another user’s browser session.

Another issue, CVE-2026-16301, rated 8.5, could allow users with the Developer role to execute downstream CI/CD pipelines on protected branches without proper authorization.

Moreover, CVE-2026-14814, another high-severity vulnerability, could allow raw repository response cache poisoning, which might cause pipelines to execute attacker-crafted content and jeopardize protected environment variables.

Additionally, GitLab patched CVE-2026-96893 in its Duo Agent Platform. This vulnerability, rated 7.3, allows authenticated users to manipulate AI agent instructions, potentially triggering unintended command execution that could be attributed to other users.

GitLab strongly recommends that affected installations be upgraded to the latest patched version. Unless the advisory specifies a particular deployment type, the guidance for affected versions applies to all deployment methods, including Omnibus, source installations, and Helm-based deployments.

Administrators should be aware of the database migrations included in this release. Single-node installations will experience downtime while migrations are completed before GitLab restarts.

In contrast, multi-node installations can avoid downtime by following the appropriate zero-downtime upgrade procedures. The version 19.3.5 update also includes post-deployment migrations.

Furthermore, the 19.3.5 update corrects a regression from version 19.3.4 that affected merge request pages when the Ona integration was enabled.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.