GitLab Patches Max-Severity Vulnerability CVE-2026-97229

GitLab fixed a critical vulnerability with a maximum CVSS score of 10.0 that could let unauthenticated attackers run code on its servers.

GitLab has addressed a critical security flaw, tracked as CVE-2026-97229 (CVSS score of 10.0), that could let attackers run code on its servers without logging in.

The flaw affects Community Edition (CE) and Enterprise Edition (EE), it is an integer overflow bug caused by weak validation of regular expressions in CI/CD configurations. The issue affects GitLab versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. Users should upgrade to a patched version to protect their systems. GitLab advisory

“GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.” reads the advisory.

The researchers joaxcar reported this vulnerability through the company’s HackerOne bug bounty program.

The company also addressed these flaws:

• CVE-2026-92883 (CVSS score: 8.7) – A security flaw where an attacker can trick another user’s web browser into running malicious JavaScript code through a specially designed repository.
• CVE-2026-16301 (CVSS score: 8.5) – An authorization flaw that lets a user with a Developer role bypass security permissions and run automated testing/deployment (CI/CD) pipelines on protected code branches.
• CVE-2026-14814 (CVSS score: 8.2) – A pattern-matching flaw that allows an attacker to manipulate cached files, causing target users’ automated pipelines to run malicious code and potentially leak sensitive environment variables.

In early October, GitLab released patches for a critical vulnerability in its AI Gateway, tracked as CVE-2026-90970 (CVSS score of 9.9), that could allow an authenticated user with access to the Duo Agent Platform to execute arbitrary commands on the gateway.

GitLab disclosed the flaw on October 2 and fixed it with the release of AI Gateway versions 19.2.4, 19.3.2 and 19.4.1.

The issue affects the way the AI Gateway handles custom flow prompt templates. According to GitLab, a user with Duo Agent Platform access could use a specially crafted flow configuration to escape the prompt template sandbox and execute commands on the AI Gateway host.

“GitLab has remediated an issue in the GitLab AI Gateway that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, leading to arbitrary command execution on the AI Gateway.” reads the advisory.

The key point is that the attack does not require an unauthenticated connection. GitLab’s advisory does not provide further details about the exact conditions required to exploit the flaw or the permissions needed beyond that access.

GitLab credited the HackerOne researcher invisiblemeerkat with responsibly reporting the vulnerability.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CVE-2026-97229)