GitLab releases critical security patches for CE and EE versions 19.2 through 19.4

GitLab released critical security updates for its Community Edition and Enterprise Edition on October 8, 2026. The company issued versions 19.4.2, 19.3.4, and 19.2.8 to address a wide range of vulnerabilities, including a remote code execution flaw that requires immediate attention from self-managed administrators.

The most severe issue, identified as CVE-2026-97229, involves an integer overflow in the CI/CD regular expression compiler. According to GitLab, this flaw could allow an unauthenticated user to execute arbitrary code on the server by submitting a specially crafted regular expression in a CI/CD configuration. The vulnerability stems from insufficient validation of these expressions within the system.

Scope of the security fixes

Beyond the remote code execution flaw, the patch releases address numerous other security defects across both editions. The advisory lists multiple incorrect authorization issues affecting various components, including GraphQL notes widgets, work item hierarchies, and scope management. These flaws could potentially allow unauthorized access to sensitive data or functionality within the platform.

Additional vulnerabilities include a cross-site scripting issue in syntax highlighting and an open redirect flaw in the Kubernetes proxy. GitLab also fixed a server-side request forgery issue in the repository import feature and a sensitive information exposure problem in GitLab Pages. Each of these issues has been remediated in the newly released versions.

Enterprise-specific and Duo Agent risks

Enterprise Edition users face specific risks related to the GitLab Duo Agent Platform. The update addresses an improper neutralization issue involving LLM prompting inputs and a governance control bypass within the same platform. These fixes are critical for organizations leveraging AI-driven features in their development workflows.

Other Enterprise Edition fixes include an incorrect authorization issue in scheduled pipeline execution policies and an incorrect privilege assignment flaw in custom roles. The patches also resolve an insufficient granularity of access control issue in project label management and an improper access control issue in project CI/CD settings.

Deployment status and affected versions

GitLab.com is already running the patched versions, so users of the SaaS offering do not need to take any action. Similarly, GitLab Dedicated customers are unaffected by these specific vulnerabilities and do not require manual intervention. The company stated that these updates apply to all deployment types, including omnibus, source code, and helm chart installations.

The advisory strongly recommends that all self-managed installations upgrade to one of the new versions immediately. GitLab releases fixes for vulnerabilities in patch releases, which include both scheduled updates and ad-hoc critical patches for high-severity issues. Scheduled releases typically occur twice a month on the second and fourth Wednesdays.

What should you do?

Administrators managing self-hosted GitLab instances should verify their current version against the affected list. If running a version prior to 19.4.2, 19.3.4, or 19.2.8, an immediate upgrade is necessary to mitigate the risk of remote code execution and other authorization bypasses. Organizations should monitor their CI/CD configurations for any signs of malicious regular expression usage during the transition.