GitLab fixes 24 vulnerabilities

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] GitLab fixes 24 vulnerabilities

GitLab fixes 24 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) in versions 19.4.2, 19.3.4 and 19.2.8, one of them critical. The most severe ones are described below; the rest can be found at [1].

GitLab CE/EE - RCE (CVE-2026-97229)

CVSS 10.0 (Critical)

Allows an unauthenticated remote attacker, due to insufficient validation of a regular expression in the CI/CD configuration, to execute arbitrary code on the GitLab server under certain conditions [1].

The vulnerability is present in products:

GitLab Community Edition; >=19.2, <19.2.8; >=19.3, <19.3.4; >=19.4, <19.4.2
GitLab Enterprise Edition; >=19.2, <19.2.8; >=19.3, <19.3.4; >=19.4, <19.4.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

CVE-2026-97229 at cve.org, NVD
CWE-190: Integer Overflow or Wraparound at cwe.mitre.org

The vulnerability was publicly disclosed 8. 10. 2026.

GitLab CE/EE - XSS (CVE-2026-92883)

CVSS 8.7 (High)

Allows an authenticated remote attacker with low privileges, due to insufficient sanitization of HTML attributes in syntax highlighting, to execute arbitrary JavaScript in another user's browser via a specially crafted repository [1].

The vulnerability is present in products:

GitLab Community Edition; >=19.1, <19.2.8; >=19.3, <19.3.4; >=19.4, <19.4.2
GitLab Enterprise Edition; >=19.1, <19.2.8; >=19.3, <19.3.4; >=19.4, <19.4.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

More information:

CVE-2026-92883 at cve.org, NVD
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 8. 10. 2026.

GitLab CE/EE - improper authorization (CVE-2026-16301)

CVSS 8.5 (High)

Allows an authenticated remote attacker with Developer role privileges, due to insufficient permission checks, to run CI/CD pipelines on protected branches [1].

The vulnerability is present in products:

GitLab Community Edition; >=18.7, <19.2.8; >=19.3, <19.3.4; >=19.4, <19.4.2
GitLab Enterprise Edition; >=18.7, <19.2.8; >=19.3, <19.3.4; >=19.4, <19.4.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

More information:

CVE-2026-16301 at cve.org, NVD
CWE-285: Improper Authorization at cwe.mitre.org

The vulnerability was publicly disclosed 8. 10. 2026.

Report feedback

[TLP:CLEAR] GitLab fixes 24 vulnerabilities

GitLab CE/EE - RCE (CVE-2026-97229)

CVSS 10.0 (Critical)

GitLab CE/EE - XSS (CVE-2026-92883)

CVSS 8.7 (High)

GitLab CE/EE - improper authorization (CVE-2026-16301)

CVSS 8.5 (High)

Links