Multiple vulnerabilities affecting Gitlab CE/EE

GitLab Community Edition (CE) and Enterprise Edition (EE) are DevOps lifecycle management platforms enabling source code repository hosting, collaboration, and continuous integration/continuous deployment (CI/CD). These solutions are affected by several vulnerabilities labeled as follows: CVE-2026-97229 (CVSS 10.0): Execution of arbitrary code on the server via the CI/CD regular expression compiler, due to an integer overflow resulting from insufficient validation of regular expressions. Exploitation of this vulnerability would allow an unauthenticated attacker to execute arbitrary code on the GitLab server via a crafted regular expression placed in a CI/CD configuration. CVE-2026-92883 (CVSS 8.7): Execution of arbitrary JavaScript code in the context of other users' session via syntax highlighting, due to improper sanitization of HTML attributes in generated output. Exploitation of this vulnerability would allow an authenticated attacker to execute this code using a specially crafted repository. CVE-2026-16301 (CVSS 8.5): Executing CI/CD pipelines on protected branches via the downstream pipeline creation service, due to improper permission checks. Exploitation of this vulnerability would allow an authenticated attacker with the Developer role to execute these pipelines without authorization. CVE-2026-14814 (CVSS 8.2): Poisoning of cached responses for raw repository files via file access, due to improper validation of repository references. Exploitation of this vulnerability could allow an attacker to execute specially crafted content through the CI/CD pipelines of targeted users and expose protected environment variables. CVE-2026-81839 (CVSS 7.7): Execution of arbitrary CI/CD pipelines in a transferred project with the new group's privileges, due to improper sanitization of scheduled pipeline execution policy records. Exploitation of this vulnerability would allow an authenticated attacker to execute these pipelines. CVE-2026-96893 (CVSS 7.3): Injection of crafted content in GitLab Duo Agent Platform AI agent instructions, due to improper neutralization of special elements during conversation context construction. Exploitation of this vulnerability would allow an authenticated malicious actor to cause the execution of unintended commands assigned to other users. CVE-2026-101168 (CVSS 6.2): ​​Access to access tokens and other secrets via GitLab Pages logs, due to the insertion of sensitive query data in log files and error tracking events. Exploitation of this vulnerability would allow an authenticated attacker with access to these logs to obtain this information. CVE-2026-7767 (CVSS 5.8): Transmission of sensitive authentication tokens to an unintended server via the Kubernetes proxy, due to incorrect validation of redirects. Exploitation of this vulnerability would allow an authenticated malicious actor controlling a Kubernetes agent to cause this transmission. CVE-2026-16275 (CVSS 5.3): Reading confidential notes on public projects via the notes component of the GraphQL API, due to incorrect permission checks. Exploitation of this vulnerability would allow an unauthenticated malicious actor to read these notes. CVE-2026-84284 (CVSS 5.3): Reading the contents of work items belonging to private groups and projects via the GraphQL API work item hierarchy, due to incorrect permission checks. Exploitation of this vulnerability would allow an unauthenticated malicious actor to read this content. CVE-2026-100755 (CVSS 4.6): Poisoning content of pages cached and served to other users via merge requests, due to incorrect construction of the cache key. Exploitation of this vulnerability would allow an authenticated malicious actor to cause this poisoning under certain deployment configurations. CVE-2026-14552 (CVSS 4.3): Reading content from confidential epics that must be restricted by external authorization via the work item GraphQL API, due to incorrect authorization checks. Exploitation of this vulnerability would allow an authenticated attacker with guest access to read this content. CVE-2026-6567 (CVSS 4.3): Access to restricted CI artifact reports via the Merge Request Accessibility Report Comparison endpoint, due to missing permission checks. Exploitation of this vulnerability would allow an authenticated malicious actor with the Reporter role to access this content. CVE-2026-104661 (CVSS 4.3): Configuration and execution of a specially crafted compliance pipeline in a group's projects via custom roles, due to improper privilege assignment. Exploitation of this vulnerability would allow an authenticated attacker with a custom role with Compliance Framework Admin permissions to carry out this execution. CVE-2026-105458 (CVSS 4.3): Obtaining a GitLab Duo Agent Platform token bypassing governance controls due to reliance on unverified input in a security decision. Exploitation of this vulnerability would allow an authenticated attacker with specific granular permission to obtain this token.

• GitLab CE/EE, versions before 19.2.8, versions 19.3 before 19.3.4, and versions 19.4 before 19.4.2;
• GitLab EE, versions before 19.2.8, versions 19.3 before 19.3.4, and versions 19.4 before 19.4.2;