GitLab patches a max-severity regex flaw alongside five high-severity bugs

Summary

GitLab released fixes for CVE-2026-97229, a max-severity integer overflow in the CI/CD regular expression compiler that could let an unauthenticated attacker execute arbitrary code on the server via a crafted regular expression in a CI/CD configuration. The fix ships with patches for five other high-severity flaws affecting CE and EE, including CVE-2026-96893, which could let an authenticated user inject crafted content into AI agent instructions.

Mitigation

Fixed in 19.4.2, 19.3.5, and 19.2.8 (Community Edition and Enterprise Edition). Self-managed administrators are urged to upgrade immediately; GitLab.com is already running the patched version and GitLab Dedicated customers need not act.

Related items

• HighCVE-2026-96893: GitLab EE prompt injection into AI agent instructions via conversation contextSimilar attack · NVD/CVE Database
• HighCVE-2026-109331: Network-AI security control bypass in ClaudeHookBridge PreToolUse hookSimilar attack · NVD/CVE Database
• InfoIntroducing AI Coding Agent Governance: Using Hooks to Bring Visibility to the ADLC | Endor LabsSimilar attack · Endor Labs Blog
• InfoHow to Secure AI Models in Production Environments | Endor LabsSimilar attack · Endor Labs Blog
• InfoContext Engineering for Application Security | Endor LabsSimilar attack · Endor Labs Blog