GitLab has released emergency updates to address CVE-2026-97229, a critical vulnerability with the maximum score of 10.0 on the CVSS scale, which allows an unauthenticated attacker to execute arbitrary code on a GitLab server. The issue affects GitLab Community Edition and Enterprise Edition versions 19.2–19.4. Administrators of self-hosted GitLab instances must install the patches immediately: fixes are available in versions 19.2.8, 19.3.5, and 19.4.2. According to the original advisory, the GitLab.com cloud service has already been updated.
Technical details of CVE-2026-97229
According to the entry in the GitHub Advisory Database, the vulnerability is classified as CWE-190 (Integer Overflow or Wraparound) — an integer overflow in the regular expression handling component for CI/CD configurations. Under certain conditions, an attacker could inject a specially crafted regular expression into a pipeline configuration and achieve arbitrary code execution on the server side. Critically important: no authentication was required for exploitation.
Affected GitLab CE/EE versions:
- 19.2 — all versions up to 19.2.8;
- 19.3 — all versions up to 19.3.5;
- 19.4 — all versions up to 19.4.2.
Entries in the NVD and the CVE Program confirm the critical severity level. At the time of publication, no independent evidence of active exploitation of CVE-2026-97229 in the wild has been found, and the vulnerability has not been added to the CISA KEV catalog. However, the absence of exploitation data does not mean it is not happening — the maximum CVSS score and the lack of any authentication requirement make this vulnerability an attractive target.
Related vulnerabilities in the same update
The GitLab 19.4.2 patch release fixes several other serious vulnerabilities confirmed by independent sources:
- CVE-2026-92883 (CVSS 8.7) — cross-site scripting (XSS) that allows an authenticated attacker to execute arbitrary JavaScript in other users’ browsers via a specially crafted repository. The issue is related to improper HTML attribute sanitization in syntax highlighting. Confirmed by the official CVE record.
- CVE-2026-16301 (CVSS 8.5, according to the original advisory) — a violation of access control checks that allowed a user with the Developer role to run CI/CD pipelines in protected branches without the appropriate permissions. It affects branches starting from 18.7, as confirmed by the entry in the GitHub Advisory Database.
Important context: different risk coverage areas
Administrators should bear in mind that the current patch release covers vulnerabilities with different branch coverage. CVE-2026-97229 affects branches 19.2–19.4, whereas the previously disclosed CVE-2026-85706 — another critical GitLab vulnerability with a CVSS score of 10.0, which allowed an unauthenticated user to read arbitrary files via the commits API — covered branches starting from 18.7 up to 19.3. CVE-2026-85706 has been added to the CISA KEV catalog with an added date of 11 September 2026 and a remediation deadline of 14 September 2026, which indicates confirmed exploitation in the wild. Details on this vulnerability are available in the GitHub Advisory, and we have already written about this vulnerability earlier.
This means that remediation should be differentiated: organizations on branches 18.7–19.1 may not be affected by CVE-2026-97229 but should have remediated CVE-2026-85706 back in September. Organizations on branches 19.2–19.4 are exposed to both threats.
Recommendations
- Update immediately any self-hosted GitLab CE/EE instances to versions 19.4.2, 19.3.5, or 19.2.8, depending on the branch you are using. Information about the patch is available in the official GitLab advisory.
- Check CI/CD pipeline configurations for suspicious or atypical regular expressions — this may indicate attempts to exploit CVE-2026-97229.
- Conduct a retrospective log analysis, especially if your instance was accessible from the internet. Pay attention to unusual access to the commits API (for CVE-2026-85706) and to the creation or modification of CI/CD configurations by unknown users (for CVE-2026-97229).
- If the instance was running a vulnerable version prior to the patch release and was publicly accessible, rotate secrets: access tokens, CI/CD environment variables, and deployment keys.
- According to the original advisory, GitLab.com and GitLab Dedicated customers do not need to take any action.
Two critical vulnerabilities with the maximum CVSS score of 10.0 in GitLab over the past two months — CVE-2026-85706 in September and CVE-2026-97229 in October — highlight the importance of prompt patch management for self-hosted instances. The priority is to update to the fixed versions immediately and perform retrospective checks for signs of compromise, especially for publicly accessible servers.
