GitLab patches critical 10/10 flaw in versions 19.4.2, 19.3.4 and 19.2.8

On October 12, 2026, GitLab released versions 19.4.2, 19.3.4 and 19.2.8 of its Community (CE) and Enterprise (EE) editions. They fix 24 vulnerabilities. The most serious, CVE-2026-97229, has the maximum score of 10 on the CVSS scale, the standard severity rating for vulnerabilities. The same day, CERT-FR, the French government's monitoring and alert center attached to ANSSI (France's national cybersecurity agency), published advisory CERTFR-2026-AVI-1294. GitLab recommends updating all self-hosted installations immediately.

A booby-trapped regular expression in the CI/CD configuration

CVE-2026-97229 is an integer overflow in the regular expression compiler used by GitLab's CI/CD (continuous integration and deployment). According to the vendor, a specially crafted regular expression in a CI/CD configuration could have allowed an unauthenticated user to execute arbitrary code on the GitLab server, "under certain conditions." GitLab does not specify which ones. The flaw was reported by researcher joaxcar through the HackerOne bug bounty program.

The affected versions are branch 19.2 before 19.2.8, 19.3 before 19.3.4 and 19.4 before 19.4.2. GitLab's bulletin reports no exploitation at this stage.

The other flaws, including a prompt injection in Duo

The patch also addresses five other high-severity flaws:

• an XSS flaw (script injection into pages) in syntax highlighting (CVE-2026-92883, score 8.7);
• an authorization flaw in the creation of downstream pipelines (CVE-2026-16301, score 8.5);
• a cache poisoning issue related to access to repository files (CVE-2026-14814, score 8.2);
• an authorization flaw in scheduled pipeline execution policies, in the EE edition (CVE-2026-81839, score 7.7);
• a prompt injection in GitLab Duo Agent Platform, the vendor's AI agent platform, in the EE edition (CVE-2026-96893, score 7.3).

The other fixes mainly concern authorization checks, notably in the GraphQL API, the package registry and access tokens.

What should you do?

• For self-hosted installations, upgrade to 19.4.2, 19.3.4 or 19.2.8, depending on your branch. GitLab recommends that all customers move to the latest patch release of a maintained version.
• GitLab.com is already patched. GitLab Dedicated customers do not need to do anything.
• The update includes database migrations: a single-server instance will be unavailable during the process. Multi-node architectures can follow the zero-downtime upgrade procedure.
• If you use the Ona integration, be aware that 19.3.4 contains a bug affecting merge request pages (merge requests). The fix is planned for 19.3.5.
• GitLab offers no workaround: updating is the only measure recommended.