GitLab Releases Critical Patches for Multiple Vulnerabilities, Including Integer Overflow and LLM Prompt Injection
GitLab has issued urgent patch versions 19.4.2, 19.3.4, and 19.2.8 to address a critical integer overflow in its CI/CD Regular Expression Compiler (CVE-2026-97229), alongside other high-severity flaws.
GitLab has released critical patch versions 19.4.2, 19.3.4, and 19.2.8 for its Community Edition (CE) and Enterprise Edition (EE) to address a significant number of vulnerabilities. The company strongly advises all self-managed GitLab installations to upgrade immediately, as GitLab.com has already been updated. GitLab Dedicated customers are not required to take any action.
The most severe of these vulnerabilities is a critical Integer Overflow issue in the CI/CD Regular Expression Compiler, identified as CVE-2026-97229. This flaw, with a CVSS score of 10.0, could allow an unauthenticated user to execute arbitrary code on the GitLab server by submitting a specially crafted regular expression in a CI/CD configuration. The vulnerability stems from insufficient validation of regular expressions.
Beyond the critical integer overflow, the patch release also addresses several high-severity vulnerabilities. These include a Cross-site Scripting (XSS) issue in syntax highlighting (CVE-2026-92883), which could allow an authenticated user to execute arbitrary JavaScript in other users' browsers. Additionally, an Improper Authorization flaw in downstream pipeline creation (CVE-2026-16301) could permit a Developer-role user to execute CI/CD pipelines on protected branches without proper authorization.
Other high-severity issues patched include a Permissive Regular Expression vulnerability in repository file access (CVE-2026-14814), which could lead to cache poisoning, and an Improper Authorization flaw in scheduled pipeline execution policies. The GitLab Duo Agent Platform is also affected by an LLM Prompt Injection vulnerability (CVE-2026-108677), rated high severity, which could allow for improper neutralization of input used for LLM prompting.
Several medium-severity vulnerabilities were also remediated, touching areas such as Sensitive Information Exposure in GitLab Pages, Open Redirect issues in the Kubernetes proxy, and various Improper Authorization and Incorrect Authorization flaws across GraphQL interfaces, merge request features, and personal access tokens. Lower-severity issues include Server Side Request Forgery (SSRF) in repository import and further authorization bypasses.
GitLab follows a structured release process for security fixes, with scheduled patch releases twice a month and ad-hoc critical patches for high-severity vulnerabilities. Details of the vulnerabilities are typically made public 90 days after the release in which they were patched, allowing users time to upgrade. The company emphasizes the importance of maintaining good security hygiene by upgrading to the latest patch releases for all supported versions.
This comprehensive patch release underscores GitLab's commitment to security, addressing a wide array of potential exploits across its platform. The inclusion of a critical RCE vulnerability and an LLM prompt injection flaw highlights the evolving threat landscape and the need for continuous vigilance and timely updates for all users of the platform.