Critical RCE in GitLab CE/EE 19.2/19.3/19.4 - CVE-2026-97229

Stored cross-site scripting in GitLab CE/EE (affected ranges 19.1 through 19.2.7, 19.3 through 19.3.4, and 19.4 through 19.4.1) lets an authenticated user with repository write access embed a crafted file whose syntax-highlighted output is rendered with unsanitized HTML attributes, executing arbitrary JavaScript in the browser session of any other user who views it. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N reflects that the attacker must be authenticated (PR:L) and that a second user must render the malicious content (UI:R), but that successful execution crosses a trust boundary (S:C) with high confidentiality and integrity impact, including potential theft of session tokens or actions taken as the victim. Exploitation requires publicly available exploit code exists, with a HackerOne report and the upstream work item publicly linked; CISA KEV status was not indicated in the supplied intelligence, so this should be treated as a high-priority authenticated stored XSS rather than a confirmed actively exploited campaign. The affected surface is bounded by the requirement for repository control plus a victim viewing the highlighted file, so unauthenticated or pure drive-by exploitation is not possible.

An authenticated user holding only the Developer role can run CI/CD pipelines on protected branches in GitLab CE/EE without authorization, because the downstream (multi-project/child) pipeline creation service failed to enforce proper permission checks (CWE-863). All versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are affected, and exploitation is conditional: it requires a valid Developer account plus projects that combine downstream pipelines with protected-branch restrictions, which is why the independent assessment raises attack complexity to High even though the vendor rates the issue 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N). Publicly available exploit code exists in the form of a HackerOne report, but the provided data contains no confirmation of active exploitation and no KEV listing. Integrity impact is the dominant risk: unauthorized pipeline execution on a protected branch can inject or alter build, test, and deployment artifacts that the branch protection model was designed to shield.

Cache poisoning of raw repository file responses in GitLab CE/EE (all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2) lets a low-privileged authenticated user supply crafted repository references so that cached raw-file content is served to other users. When a targeted victim's CI/CD pipeline subsequently fetches that poisoned raw file, the pipeline executes attacker-controlled content, potentially exposing protected environment variables. Publicly available exploit code exists (referenced via a HackerOne report), but the issue is not confirmed as actively exploited (no CISA KEV listing); exploitation is rated high complexity (AC:H), requires authentication (PR:L), and success depends on a victim pipeline actually pulling and running the poisoned content, making this a credible, high-priority issue rather than an emergency.

Improper cleanup of scheduled pipeline execution policy records in GitLab Enterprise Edition lets an authenticated user execute arbitrary CI/CD pipelines in a transferred project using the destination group's privileges. Affected releases are all EE versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. Exploitation is conditional - the attacker needs a valid account, a project that has a configured scheduled pipeline execution policy, the project-transfer workflow, and user interaction (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N, 7.7) - but publicly available exploit code exists per the referenced HackerOne report, and no CISA KEV entry has been recorded, so this is a moderate, conditional privilege-escalation risk rather than a mass-exploitation emergency.

Authenticated users of GitLab Enterprise Edition can inject specially crafted content into the context that AI agent features assemble, allowing unintended commands to be executed and attributed to other users. The issue affects GitLab EE from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2, and exploitation requires a valid EE account (PR:L), the AI agent/conversation feature to be enabled and in use, and a separate victim user to trigger the affected AI interaction (UI:R), so realistic exposure is substantially narrowed despite the network attack vector. No public exploit code or confirmed active exploitation was identified at time of analysis; vendor-released patches are available in versions 19.2.8, 19.3.5, and 19.4.2.

Information disclosure in GitLab Pages (GitLab CE/EE) lets an authenticated user who already holds access to Pages log data recover access tokens and other secrets, because sensitive request data was written into log files and forwarded to error-tracking events. All GitLab CE/EE versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are affected, per CWE-532 (insertion of sensitive information into a log file). The assessed CVSS is 6.2 and the privilege requirement is high (PR:H) - the attacker must be an authenticated user who can already read the affected Pages logs, so this is not remotely reachable by anonymous users against a default configuration; no public exploit code or active exploitation has been identified at time of analysis. Impact is limited to disclosure of whatever tokens or secrets happened to be captured in logging or error tracking, but because the leaked credentials can span security boundaries the change scope is rated S:C.

Authentication token leakage in GitLab CE/EE (all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2) allows an authenticated user who controls a Kubernetes agent to redirect the Kubernetes proxy to an unintended server, exposing sensitive authentication tokens. Exploitation requires user interaction and only affects instances using the GitLab Kubernetes agent/proxy integration; publicly available exploit code exists. This moderate-severity issue (CVSS 5.8) is not a top-tier emergency but should be patched by affected deployments.

Unauthenticated information disclosure in GitLab CE/EE allows remote attackers to read confidential notes on public projects because of incorrect authorization checks, affecting versions from 17.4 up to specific branch fix releases. The flaw carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), so exploitation needs no credentials or user interaction and is confined to confidentiality. Publicly available exploit code exists via a HackerOne report, but there is no confirmed active exploitation (CISA KEV not listed); GitLab states the issue is only exploitable under certain conditions, so not every public project is necessarily affected.