cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

GitLab Patches Critical Flaw That Could Enable Unauthenticated Server Code Execution

· Original article ↗

Summary

GitLab patched CVE-2026-97229, a CVSS 10.0 flaw that could let unauthenticated users execute code on a server through a crafted regular expression in CI/CD configuration.

Key points

  • GitLab says insufficient regular-expression validation could allow unauthenticated arbitrary code execution under certain conditions.
  • The flaw is tracked as CVE-2026-97229 and described as an integer overflow issue; it affects GitLab Community Edition and Enterprise Edition.
  • Patches are available in versions 19.4.2, 19.3.5, and 19.2.8.
  • The article also notes a recently patched critical AI Gateway flaw and a separate maximum-severity GitLab flaw that saw in-the-wild probes after disclosure.

Article Details

Vulnerability Types
  • Integer overflow
  • Insufficient regular expression validation
Severity
CVSS 10.0
Exploitation Status
unknown
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2026-85706Last month, another maximum-severity security flaw in GitLab CE and EE (CVE-2026-85706, CVSS score: 10.0) witnessed in-the-wild probes within hours of public disclosure.CVE-2026-90970The disclosure comes weeks after it remediated a critical flaw in AI Gateway (CVE-2026-90970, CVSS score: 9.9) that could have allowed an authenticated user with Duo Agent Platform access to break out of the promptCVE-2026-97229The flaw, tracked as CVE-2026-97229, has been described as an integer overflow issue. It carries a CVSS score of 10.0. It affects the following versions -

Vendors

GitLabGitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result in arbitrary code execution.

Products

AI GatewayThe disclosure comes weeks after it remediated a critical flaw in AI Gateway (CVE-2026-90970, CVSS score: 9.9) that could have allowed an authenticated user with Duo Agent Platform access to break out of the promptDuo Agent Platformin AI Gateway (CVE-2026-90970, CVSS score: 9.9) that could have allowed an authenticated user with Duo Agent Platform access to break out of the prompt template sandbox via a specially crafted flow configuration andGitLab Community Edition (CE)GitLab Enterprise Edition (EE)

Related Articles