{"id":3507,"date":"2026-10-13T15:39:58","date_gmt":"2026-10-13T15:39:58","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3507"},"modified":"2026-10-13T15:39:58","modified_gmt":"2026-10-13T15:39:58","slug":"gitlab-patches-cvss-10-0-flaw-that-could-let-unauthenticated-users-run-server-code","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3507","title":{"rendered":"GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Oct 13, 2026<\/span><\/span><span class=\"p-tags\">Vulnerability \/ DevSecOps<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgOWNiMkzMghhERT5BPyrVI9JdCWExRLtDNHIHPjmT_WnGhLHyWhahW3xPurPPQJUn7Yz0_g9Nk0zWinEKh4J71g9viLtNVx2fM2anNzhA514PAgZBxobRfeP1jSsovLI6iVi9HIUXxv_dLvK8DrKy5vZktoxrxyd0riB83XCR2dlne7lEgTqdXW1Rwhekz\/s1700-nu-rw-lo-l85-e365\/gitlab-exploit.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result in arbitrary code execution.<\/p>\n<p>\u00abGitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI\/CD configuration, due to insufficient regular expression validation,\u00bb the company <a href=\"https:\/\/docs.gitlab.com\/releases\/patches\/patch-release-gitlab-19-4-2-released\/\" target=\"_blank\">said<\/a> in a Monday advisory.<\/p>\n<p>The flaw, tracked as <strong>CVE-2026-97229<\/strong>, has been described as an integer overflow issue. It carries a CVSS score of 10.0. It affects the following versions &#8211;<\/p>\n<ul>\n<li>All versions from 19.2 before 19.2.8<\/li>\n<li>All versions from 19.3 before 19.3.5, and<\/li>\n<li>All versions from 19.4 before 19.4.2<\/li>\n<\/ul>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/network-defense-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjVV2rRkX8tRMF6gCzemvQNpwFwGxRWxY1cJEYfoLLSj1EZYJOlj5WTR77t0i6kELXujYcaHTpRDqTjCbVHH5Pnh7wzxUiKP5j4dsDkWIMlp2bmpZsL0jeAsA_19pHH5UPtyBvNkZdyGEULOAsXPcraMP5CYjQRFefhXRSdEjYkrdcpUnc4ILcvcdEfAauE\/s728-nu-rw-lo-l85-e365\/tl-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>Patches for the flaw are available in versions 19.4.2, 19.3.5, and 19.2.8. Also addressed are three high-severity bugs &#8211;<\/p>\n<ul>\n<li><strong>CVE-2026-92883<\/strong> (CVSS score: 8.7) &#8211; A cross-site scripting vulnerability that could allow an authenticated user to execute arbitrary JavaScript in the context of other users&#8217; browser sessions via a specially crafted repository.<\/li>\n<li><strong>CVE-2026-16301<\/strong> (CVSS score: 8.5) &#8211; An improper authorization vulnerability in the downstream pipeline creation service that could allow an authenticated user with Developer role to execute CI\/CD pipelines on protected branches.<\/li>\n<li><strong>CVE-2026-14814<\/strong> (CVSS score: 8.2) &#8211; A permissive regular expression vulnerability that could allow a user to poison cached responses for raw repository files, causing targeted users\u2019 CI\/CD pipelines to execute specially crafted content and potentially exposing protected environment variables.<\/li>\n<\/ul>\n<p>The disclosure comes weeks after it remediated a critical flaw in AI Gateway (CVE-2026-90970, CVSS score: 9.9) that could have allowed an authenticated user with Duo Agent Platform access to break out of the prompt template sandbox via a specially crafted flow configuration and achieve arbitrary command execution on the AI Gateway.<\/p>\n<p>Last month, another maximum-severity security flaw in GitLab CE and EE (CVE-2026-85706, CVSS score: 10.0) witnessed in-the-wild probes within hours of public disclosure.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802Oct 13, 2026Vulnerability \/ DevSecOps GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result in arbitrary&hellip;<\/p>\n","protected":false},"author":1,"featured_media":3508,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[10,497,70,2717,57,1774,518,725,826],"class_list":["post-3507","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-code","tag-cvss","tag-flaw","tag-gitlab","tag-patches","tag-run","tag-server","tag-unauthenticated","tag-users"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3507","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3507"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3507\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3508"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3507"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3507"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3507"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}