GitLab patches CVSS 10 flaw letting unauthenticated attackers run code on servers

GitLab released critical patch versions 19.4.2, 19.3.4 and 19.2.8 on October 12 to fix a maximum-severity vulnerability that could let an unauthenticated attacker execute arbitrary code on self-managed GitLab servers. The flaw, tracked as CVE-2026-97229 and rated 10.0 on the CVSS scale, sits in the component that compiles regular expressions found in CI/CD pipeline configuration files. GitLab "strongly recommends" that all self-managed installations upgrade immediately.

What happened

According to GitLab's advisory, CVE-2026-97229 is an integer overflow issue in the CI/CD Regular Expression Compiler of GitLab Community Edition (CE) and Enterprise Edition (EE). The company says that under certain conditions an unauthenticated user could execute arbitrary code on the GitLab server by using a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. The flaw was reported by the researcher known as joaxcar through GitLab's HackerOne bug bounty program.

The same release addresses 24 vulnerabilities in total. Besides the critical bug, GitLab lists four high-severity issues: a cross-site scripting flaw in syntax highlighting (CVE-2026-92883, CVSS 8.7), a bug that let developers run pipelines on protected branches without authorization (CVE-2026-16301, CVSS 8.5), cache poisoning of raw repository file responses that could put protected CI/CD variables at risk (CVE-2026-14814, CVSS 8.2), and an EE-only issue in which scheduled pipeline policy records persist after a project transfer (CVE-2026-81839, CVSS 7.7). Another EE-only high-severity bug involves unsanitized input in AI conversation context that could trigger unintended agent commands.

Who is affected

The critical flaw affects self-managed GitLab CE and EE on the 19.2 branch before 19.2.8, the 19.3 branch before 19.3.4 and the 19.4 branch before 19.4.2. GitLab says GitLab.com is already running the patched version and GitLab Dedicated customers do not need to take action.

BleepingComputer notes that the advisory does not report exploitation in the wild. However, the outlet points out that GitLab vulnerabilities have been targeted before: CISA added a maximum-severity GitLab path traversal flaw, CVE-2026-85706, to its Known Exploited Vulnerabilities catalog one day after its disclosure in August, and five GitLab flaws have been flagged as exploited since November 2021, one of them by ransomware groups. GitLab says it has more than 30 million registered users.

What to do

• Upgrade self-managed instances to 19.4.2, 19.3.4 or 19.2.8, or a later release on the same branch, as soon as possible.
• GitLab warns that 19.3.4 includes post-deploy migrations and that single-node instances will experience downtime during the upgrade.
• GitLab also notes a known issue in 19.3.4 affecting merge request pages when the Ona integration is enabled; the fix is planned for 19.3.5.
• Until patched, administrators should limit who can modify CI/CD configuration and review recent pipeline configuration changes for unusual regular expressions.