Patch GitLab CE and EE to Block Unauthenticated Remote Code Execution

GitLab released security patches on October 12, 2026, addressing twenty-four distinct issues. The most severe is CVE-2026-97229, a critical vulnerability in the CI/CD regular expression compiler. CERT-EU advises that self-managed instances of GitLab Community Edition and Enterprise Edition must upgrade to fixed versions immediately, prioritizing those exposed to the internet.

The risk

The vulnerability stems from weak validation of regular expressions within the CI/CD pipeline configuration. According to CERT-EU, this weakness leads to an integer overflow condition. An unauthenticated attacker can exploit this by submitting a specially crafted regular expression. This action triggers arbitrary code execution on the server hosting the GitLab instance. The flaw carries a CVSS score of 10.0, indicating maximum severity.

Who is exposed

This vulnerability affects self-managed deployments of GitLab CE and EE. Specific versions prior to the patch release remain vulnerable. The advisory highlights that internet-facing instances face the highest immediate risk. Organizations running older versions of GitLab 19.4, 19.3, or 19.2 are directly impacted. Cloud-hosted GitLab users are not mentioned as affected in this specific advisory.

Cost and compliance

The October 12 release also resolves other significant security defects. CVE-2026-92883 is a cross-site scripting flaw with a CVSS score of 8.7. It allows authenticated users to execute arbitrary JavaScript in other users' browsers through crafted repositories. CVE-2026-16301, rated 8.5, is an authorization flaw. It permits developers to run pipelines on protected branches without proper permission. Twenty-one additional issues were fixed, including a cache poisoning bug rated 8.2 that could expose protected CI/CD variables.

Our take on the response

That suggests a coordinated effort to address multiple attack vectors within the CI/CD ecosystem. Managers should verify their current version numbers against the patch list. Prioritizing internet-facing servers reduces the immediate window for unauthenticated exploitation.

Background: Cross-site scripting (XSS)

Cross-site scripting exploits the trust a browser places in a web page. An attacker injects malicious scripts into a vulnerable site. When another user visits that page, their browser executes the script. The attacker steals session tokens or redirects the victim. Proper input validation and output encoding stop this process.

Read the full guide: How Cross-Site Scripting Works Step by Step

What to do and how to stay safe: GitLab

• Identify all self-managed GitLab CE and EE instances in your environment.
• Check current version numbers against the vulnerable ranges listed in the advisory.
• Upgrade internet-facing instances to versions 19.4.2, 19.3.4, or 19.2.8 immediately.
• Monitor CI/CD logs for unusual activity or failed pipeline executions while planning upgrades.

Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which GitLab versions are affected by CVE-2026-97229?

Self-managed versions of GitLab CE and EE prior to 19.4.2, 19.3.4, and 19.2.8 are affected.

Is authentication required to exploit this vulnerability?

No, CERT-EU states that an unauthenticated attacker can execute arbitrary code on the server.

What other vulnerabilities were fixed in this release?

The release fixes CVE-2026-92883, CVE-2026-16301, and twenty-one other issues including a cache poisoning bug.