1.0 Introduction
Recently, GitLab has released security updates to address multiple vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE).
2.0 Impact
The critical flaw, CVE-2026-97229 (CVSS 10.0), is an integer overflow in the CI/CD regular expression compiler. Under certain conditions it could allow an unauthenticated user to execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration. The high-severity flaws include cross-site scripting in syntax highlighting (CVE-2026-92883), improper authorisation allowing Developer-role users to run CI/CD pipelines on protected branches (CVE-2026-16301), cache poisoning that could expose protected environment variables (CVE-2026-14814), and flaws in pipeline execution policies and the GitLab Duo Agent Platform. Other issues include access control weaknesses and information disclosure. This may lead to execution of arbitrary code, unauthorised access to source code and CI/CD secrets, and system compromise.
3.0 Affected Products
- GitLab CE/EE versions from 19.1 before 19.2.8 (CVE-2026-97229)
- GitLab CE/EE 19.3 versions before 19.3.4
- GitLab CE/EE 19.4 versions before 19.4.2
4.0 Recommendation
CyberSecurity
Malaysia encourages users and administrators to review the following GitLab
patch release notes and apply the necessary updates. GitLab strongly recommends
that all self-managed installations be upgraded to 19.4.2, 19.3.4 or 19.2.8
immediately. GitLab.com is already patched and GitLab Dedicated customers do
not need to act. Single-node instances will experience downtime during the
upgrade because database migrations must complete before GitLab can start.
Kindly refer to the following URL:
Generally, we advise users to be
updated with the latest security announcements by the vendor and follow best
practice security policies to determine which updates should be applied.
For further enquiries, please contact Cyber999
Incident Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my
5.0 References
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released