A permissive regular expression in GitLab allows an attacker who can influence repository references to poison the cache for raw repository files. When a target’s CI/CD pipeline retrieves a poisoned cached object, the pipeline executes specially crafted content, potentially exposing protected environment variables. This flaw is an improper validation weakness categorized as CWE‑625, and it threatens confidentiality, integrity, and availability of software builds.

GitLab Community Edition and Enterprise Edition are affected. All releases prior to version 19.2.8, prior to 19.3.5, and prior to 19.4.2 contain the vulnerability and should be upgraded.

The CVSS score of 8.2 classifies the issue as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but this does not diminish the risk. The likely attack vector is an attacker with write or reference‑influence access who can embed malicious references that poison cached raw file responses; when the target’s pipeline later retrieves the cached object, the injected content is executed. Thus, depending on the host’s CI/CD configuration, the flaw could lead to privileged code execution and data exfiltration.