Ethical Hacking News
GitLab has discovered a critical vulnerability in its Community Edition and Enterprise Edition software that could allow an unauthenticated user to execute arbitrary code on the server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. The vulnerability carries a CVSS score of 10.0 and has been assigned a CVE-2026-97229. GitLab has released patches for the affected versions of the software, and it is essential for users to update their software to the latest version to prevent exploitation. This is a serious security concern that should not be taken lightly, and it highlights the importance of staying vigilant and proactive in terms of security.
GitLab has discovered a critical vulnerability in its Community Edition and Enterprise Edition software, allowing an unauthenticated user to execute arbitrary code on the server via a specially crafted regular expression. The vulnerability has a CVSS score of 10.0, making it one of the most severe security flaws discovered in recent times. Patches are available in versions 19.4.2, 19.3.5, and 19.2.8, and users are recommended to update their software to the latest version to prevent exploitation. The vulnerability can lead to serious consequences, including data theft, system compromise, and physical access to the server. GitLab has addressed other high-severity bugs, including a cross-site scripting vulnerability and improper authorization vulnerabilities. It is essential for organizations to ensure their software is up-to-date and patched, particularly for critical systems like version control and developer platforms.
GitLab, a popular version control system and developer platform, has recently discovered a critical vulnerability in its Community Edition and Enterprise Edition software that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. This vulnerability, tracked as CVE-2026-97229, carries a CVSS score of 10.0, making it one of the most severe security flaws discovered in recent times.
The vulnerability was discovered by GitLab's security team, which promptly released patches for the affected versions of the software. The patches are available in versions 19.4.2, 19.3.5, and 19.2.8, which are recommended for immediate installation to prevent exploitation. It is essential for users to update their software to the latest version to ensure their systems are protected from this critical vulnerability.
GitLab's community edition and enterprise edition software have been compromised due to a flaw in the regular expression validation. This vulnerability can allow an attacker to execute arbitrary code on the server, potentially leading to a range of serious consequences, including data theft, system compromise, and even physical access to the server. The vulnerability is so severe that it has been assigned a CVSS score of 10.0, which is the highest rating possible under the Common Vulnerability Scoring System.
Furthermore, the vulnerability was discovered just weeks after another critical flaw was discovered in GitLab's AI Gateway software, which could have allowed an authenticated user with Duo Agent Platform access to break out of the prompt template sandbox via a specially crafted flow configuration and achieve arbitrary command execution on the AI Gateway. This vulnerability was also assigned a CVSS score of 9.9, making it one of the most severe security flaws discovered in recent times.
This latest vulnerability highlights the importance of keeping software up-to-date and patched, particularly for organizations that rely on version control systems and developer platforms. It also underscores the need for robust security measures to prevent exploitation of vulnerabilities like this one. GitLab's swift response to this vulnerability and the availability of patches in the affected versions of the software are a testament to the company's commitment to ensuring the security of its users.
In addition to this critical vulnerability, GitLab has also addressed three other high-severity bugs, including a cross-site scripting vulnerability that could allow an authenticated user to execute arbitrary JavaScript in the context of other users' browser sessions via a specially crafted repository. This vulnerability carries a CVSS score of 8.7, making it a serious security concern that should be addressed immediately.
Furthermore, GitLab has also addressed an improper authorization vulnerability in the downstream pipeline creation service that could allow an authenticated user with Developer role to execute CI/CD pipelines on protected branches. This vulnerability carries a CVSS score of 8.5, making it another serious security concern that should be addressed immediately.
Finally, GitLab has also addressed a permissive regular expression vulnerability that could allow a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute specially crafted content and potentially exposing protected environment variables. This vulnerability carries a CVSS score of 8.2, making it a significant security concern that should be addressed immediately.
The discovery of this critical vulnerability in GitLab's software highlights the importance of staying vigilant and proactive in terms of security. It also underscores the need for organizations to ensure that their software is up-to-date and patched, particularly for critical systems like version control and developer platforms.
In conclusion, the discovery of this critical vulnerability in GitLab's software is a serious security concern that should not be taken lightly. It highlights the importance of staying vigilant and proactive in terms of security and the need for organizations to ensure that their software is up-to-date and patched.
Related Information:
https://www.ethicalhackingnews.com/articles/GitLab-Discovers-Critical-Vulnerability-in-Community-Edition-Patch-Available-Now-ehn.shtml
https://thehackernews.com/2026/10/gitlab-patches-cvss-100-flaw-that-could.html
Published: Tue Oct 13 05:20:33 2026 by llama3.2 3B Q4_K_M
