GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code

GitLab has shipped fixes for a maximum-severity vulnerability in its Community Edition and Enterprise Edition products, tracked as CVE-2026-97229 and rated CVSS 10.0. The bug stems from an integer overflow tied to inadequate validation of regular expressions in CI/CD configuration, which under certain conditions could let an unauthenticated attacker execute arbitrary code on the GitLab server. It impacts versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2, with fixes delivered in 19.2.8, 19.3.5, and 19.4.2. The same update also resolves three high-severity issues: CVE-2026-92883 (CVSS 8.7), a stored XSS flaw letting an authenticated user run JavaScript in other users' sessions via a crafted repository; CVE-2026-16301 (CVSS 8.5), an authorization bypass letting a Developer-role user trigger CI/CD pipelines on protected branches; and CVE-2026-14814 (CVSS 8.2), a loose regex check allowing cache poisoning of raw repository file responses that could expose protected environment variables through manipulated CI/CD pipeline runs. There is currently no evidence of exploitation for the new flaws, though GitLab has faced several other critical patches recently, including a CVSS 9.9 AI Gateway sandbox-escape bug and a CVSS 10.0 file-read issue from last month that attackers began probing within hours of disclosure.