GitLab Critical Patch Release: 19.4.2, 19.3.4, 19.2.8

GitLab released versions 19.4.2, 19.3.5, and 19.2.8 on October 12, 2026, to address critical bugs and security vulnerabilities in GitLab Community Edition and Enterprise Edition. Version 19.3.4 contained a bug affecting merge request pages when the Ona integration was enabled, which has been resolved in 19.3.5. The updates include fixes for high-severity issues and are strongly recommended for all self-managed installations. GitLab.com is already running the patched versions, and GitLab Dedicated customers do not require action.

One vulnerability allowed unauthenticated users to execute arbitrary code on GitLab servers via a crafted regular expression in CI/CD configurations due to insufficient validation. This issue impacted versions before 19.2.8, 19.3.5, and 19.4.2, with a CVSS score of 10.0. Another flaw permitted authenticated users to execute arbitrary JavaScript in other users' browser sessions through improperly sanitized repository content, affecting versions before 19.2.8, 19.3.5, and 19.4.2, with a CVSS score of 8.7.

A third vulnerability enabled authenticated users with Developer roles to run CI/CD pipelines on protected branches without authorization due to flawed checks in downstream pipeline creation. This issue impacted versions from 18.7 onward before 19.2.8, 19.3.5, and 19.4.2, with a CVSS score of 8.5. Additionally, a flaw allowed users to poison cached responses for raw repository files, potentially exposing protected environment variables, with a CVSS score of 8.2.

GitLab also addressed vulnerabilities allowing users to inject crafted content into AI agent instructions, potentially causing unintended command execution. These issues affected Enterprise Edition versions before 19.2.8, 19.3.5, and 19.4.2, with CVSS scores ranging from 7.3 to 7.7. All vulnerabilities were reported through GitLab's HackerOne bug bounty program and have been remediated in the latest patches.