Security Advisory

GitLab Product Security Update Advisory

A security update has been released to address several vulnerabilities in GitLab products.
The affected products are GitLab CE/EE and GitLab AI Gateway.
The vulnerabilities in GitLab CE/EE include the following:
- CVE-2026-14814: Insufficient regular expression validation vulnerability.
- CVE-2026-16301: Inappropriate authorization vulnerability.
- CVE-2026-92883: XSS vulnerability (a vulnerability where malicious scripts are injected into web pages)
- CVE-2026-97229: Integer overflow or wrap-around vulnerability.
GitLab AI Gateway contains the CVE-2026-90970 vulnerability due to insufficient handling of special characters.
Affected Versions vary by CVE; for GitLab CE/EE, this includes versions prior to 19.2.8, As well as versions 19.3 Through 19.3.5 And 19.4 Through 19.4.2.
For GitLab AI Gateway, affected versions are 18.1.6 Through 19.2.4, 19.3 Through 19.3.2, And 19.4 Through 19.4.1.
The versions for which patches are available are 19.2.8, 19.3.5, And 19.4.2 For GitLab CE/EE, and 19.2.4, 19.3.2, And 19.4.1 For GitLab AI Gateway.
Users of these products must update to the latest version of the patch listed above.