GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthe…
Critical CVSS 10.0 Listed in CISA KEV
Summary
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- GitLab:Community Edition and Enterprise Edition
Sources
- NVD DATABASE
- CISA KEV DATABASE
- Grok bot vulnerability crawler DATABASE
Original Links
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
- https://gitlab.com/gitlab-org/gitlab/-/work_items/630686
- https://hackerone.com/reports/4055749
- https://hackerone.com/reports/4058589
- https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves reference
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk reference
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk reference
- https://nvd.nist.gov/vuln/detail/CVE-2026-97229 reference
Timeline
- nvd_ingest NVD
- kev_ingest CISA KEV
- grok_bot_ingest Grok bot vulnerability crawler