{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/gitlab-enterprise-edition--19.4.2-19.3.4-19.2.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GitLab Community Edition (\u003c 19.4.2, 19.3.4, 19.2.8)","GitLab Enterprise Edition (\u003c 19.4.2, 19.3.4, 19.2.8)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","rce","devops"],"_cs_type":"advisory","_cs_vendors":["GitLab"],"content_html":"\u003cp\u003eOn 12 October 2026, GitLab issued emergency security patches to address 24 distinct vulnerabilities affecting self-managed GitLab Community Edition (CE) and Enterprise Edition (EE). The most severe issue is CVE-2026-97229 (CVSS 10.0), a critical vulnerability within the CI/CD regular expression compiler. This flaw stems from weak validation of regular expressions, resulting in an integer overflow that can be leveraged by unauthenticated attackers to achieve arbitrary code execution on the underlying server.\u003c/p\u003e\n\u003cp\u003eIn addition to the remote code execution vulnerability, the patches address several other high-impact security flaws. These include CVE-2026-92883 (CVSS 8.7), a cross-site scripting (XSS) vulnerability in syntax highlighting that permits authenticated users to execute malicious JavaScript in the context of other users' browsers, and CVE-2026-16301 (CVSS 8.5), which allows unauthorized execution of pipelines on protected branches. Given the severity of CVE-2026-97229, immediate remediation is required for all internet-facing instances.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability CVE-2026-97229 enables unauthenticated remote code execution, which grants an attacker full control over the affected GitLab server. Successful exploitation could lead to the theft of repository source code, compromise of CI/CD pipeline secrets, and potential lateral movement into the build environment or internal network. Other vulnerabilities, such as cache poisoning and authorization bypasses, further increase the risk of credential theft and unauthorized access to protected internal resources.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade all self-managed GitLab CE/EE instances to version 19.4.2, 19.3.4, or 19.2.8 to mitigate CVE-2026-97229, CVE-2026-92883, and CVE-2026-16301.\u003c/li\u003e\n\u003cli\u003ePrioritize patching of internet-facing instances.\u003c/li\u003e\n\u003cli\u003eAudit CI/CD configurations for anomalous regular expression patterns that may attempt to trigger the integer overflow identified in CVE-2026-97229.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:29:32Z","date_published":"2026-10-12T18:29:32Z","id":"https://feed.craftedsignal.io/briefs/2026-10-gitlab-vulnerabilities/","summary":"GitLab released security updates for 24 vulnerabilities, including a critical unauthenticated RCE via integer overflow (CVE-2026-97229) in the CI/CD regular expression compiler.","title":"Critical RCE Vulnerability in GitLab CE and EE","url":"https://feed.craftedsignal.io/briefs/2026-10-gitlab-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - GitLab Enterprise Edition (\u003c 19.4.2, 19.3.4, 19.2.8)","version":"https://jsonfeed.org/version/1.1"}