Officially

From the publisher, in order, with its history intact.

CERT-EU cert.europa.eu

2026-016: Critical Vulnerability in GitLab CE and EE

Imported from official source

Advisory

Cybersecurity Classified by Officially

Critical Vulnerability in GitLab CE and EE

  • 12/10/2026 --- v1.0 -- Initial publication

    • On 12 October 2026, GitLab released versions 19.4.2, 19.3.4 and 19.2.8 of GitLab Community Edition (CE) and Enterprise Edition (EE), fixing 24 security issues among which a critical vulnerability that could allow an unauthenticated attacker to execute arbitrary code on the server [1].

    CERT-EU strongly recommends upgrading self-managed GitLab CE/EE instances to a fixed version as soon as possible, starting with internet-facing instances.

    The vulnerability CVE-2026-97229, with a CVSS score of 10.0, is located in the CI/CD regular expression compiler [1]. Weak validation of regular expressions leads to an integer overflow, and a specially crafted expression in a CI/CD configuration can then trigger code execution [1].

    The same release also fixes other vulnerabilities [1]:

  • CVE-2026-92883 (CVSS: 8.7): a cross-site scripting flaw in syntax highlighting that lets an authenticated user run arbitrary JavaScript in other users' browsers through a crafted repository [1].
  • CVE-2026-16301 (CVSS: 8.5): an authorisation flaw that lets a developer run pipelines on protected branches without permission [1].
  • 21 further issues, including a cache poisoning bug rated 8.2 that could expose protected CI/CD variables [1].

    • The vulnerabilities affect the following versions of self-managed GitLab CE/EE instances [1]:

    This is an extract. The publication continues at the source.

    Source: CERT-EU.

    Read the original at the source: https://cert.europa.eu/publications/security-advisories/2026-016/

    Officially imported this from CERT-EU’s own source and shows an extract. If you work there, claiming the profile and verifying the domain lets you choose to show the full text here.

    Provenance

    Organization
    CERT-EU — imported from official source
    Official source
    https://www.cert.europa.eu/publications/security-advisories-rss RSS
    Imported
    October 12, 2026 13:00
    Versions
    1 recorded
    Identity
    security-advisories-10953

    Officially records where a publication came from, not whether it is true. Imported records are reproduced from an organization's own official source.