GitLab

GitLab's 19.4.2 patch fixes a CVSS 10.0 remote code execution in the CI/CD regex compiler

An ad-hoc critical release shipped 24 security fixes on 2026-10-12. The headline is an unauthenticated remote code execution in the CI/CD regular-expression compiler, and two flaws in the GitLab Duo Agent Platform. Self-managed instances should upgrade now.

Glenn Fryklund

Glenn Fryklund

— 3 min read
Share
GitLab's 19.4.2 patch fixes a CVSS 10.0 remote code execution in the CI/CD regex compiler
A regular-expression string, far too long for the compiler unit it is fed into, overflows and cracks the unit, leaking sparks. Rendered with AI. The post is about an integer overflow in GitLab's CI/CD regex compiler (CVE-2026-97229) that lets an unauthenticated user run arbitrary code on the server.

GitLab released 19.4.2, 19.3.5, and 19.2.8 on 2026-10-12, an ad-hoc critical patch that bundles 24 security fixes. The urgency comes from a CVSS 10.0 flaw that an unauthenticated user can trigger from a regular expression in a CI/CD configuration, which is why GitLab is telling self-managed operators to upgrade immediately.

The headline is CVE-2026-97229, an integer overflow in the regular-expression compiler that GitLab's CI/CD pipeline uses to turn a pattern in a .gitlab-ci.yml into a working regex. Under certain conditions the overflow lets an unauthenticated user execute arbitrary code on the GitLab server. The NVD scores it 10.0 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), and it was reported through the HackerOne bug bounty by a researcher going by joaxcar.

The trigger is the point. A regex in a pipeline config is an ordinary, expected artifact. Every GitLab user writes one; it is not a backdoor or a hidden endpoint. The overflow lives in the compiler that parses that ordinary input, so the boundary between a legitimate pipeline and hostile input is drawn exactly where the compiler does its work. No compromised account is required; the whole attack is a crafted regex in a config the server parses.

That is the difference between a bug in a feature and a bug in the surface every user touches. The affected versions are all of 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2; the fix lands in 19.2.8, 19.3.5, and 19.4.2.

The release also fixes two flaws in the GitLab Duo Agent Platform, both Enterprise Edition only. CVE-2026-96893 is an improper-neutralization-of-input flaw in LLM prompting, scored 7.3 HIGH. An authenticated user could inject specially crafted content into an AI agent's instructions in a way that leads to unintended command execution; GitLab's own team member Mert Coskuner found it. CVE-2026-105458 is a governance-control bypass, scored 4.3 MEDIUM: a user holding one specific granular permission could obtain a Duo Agent Platform token that bypasses governance controls, found internally by Rahul Barnwal.

Read those two together and the Enterprise Edition story is not one bug but a pair. The prompt-injection gives an authenticated user a path to steer an agent toward command execution, and the governance bypass gives a suitably-permissioned user a token that sidesteps the controls meant to bound that same agent. One is about what an agent can be told to do; the other is about what a token can be made to skip. For a self-managed Enterprise Edition instance, both need the patch, and the prompt-injection is the higher-severity of the two.

The remaining 21 fixes span authorization, access-control, cross-site scripting, open-redirect, server-side request forgery, and information-exposure issues. A few carry their own weight: CVE-2026-100104 is a server-side request forgery in repository import (CVSS 3.5), CVE-2026-101168 is sensitive information exposure in GitLab Pages (CVSS 6.2), and CVE-2026-92883 is an XSS in syntax highlighting (CVSS 8.7). Each has an affected-version bound and a fix in 19.2.8, 19.3.5, or 19.4.2.

One detail is easy to miss. The patch shipped on 2026-10-12, but the NVD records for the three named CVEs were published on 2026-10-13. The fix existed a day before the vulnerability records landed in the index. For a self-managed operator, that means the vendor advisory is the thing you act on, not the CVE. In a CVSS 10.0 unauthenticated RCE, the only thing standing between you and the bug during that gap is the upgrade.

GitLab says GitLab.com is already running the patched version. For self-managed instances the message is to upgrade immediately. The CISA Known Exploited Vulnerabilities catalog does not list any of these, and no in-the-wild exploitation is asserted in the public record as of this writing. The detailed per-CVE write-ups are not all expanded in the release notes; GitLab publishes the full issue details on its tracker 90 days after the patch. The numbers and version bounds above come from the advisory and the NVD records.

Sources

Feature image: /gen/malwlab_gitlab_19.4.2_cover.png (4096x2304, rendered with AI)

Feature image caption: A regular-expression string, far too long for the compiler unit it is fed into, overflows and cracks the unit, leaking sparks. Rendered with AI. The post is about an integer overflow in GitLab's CI/CD regex compiler (CVE-2026-97229) that lets an unauthenticated user run arbitrary code on the server.

This article was drafted with AI/LLM assistance and reviewed by a human before publication. All factual claims were checked against the public sources cited above. The feature image was generated with AI. See How we use AI for the full workflow.

Topics:

Read more