GitLab patches critical CVSS 10.0 CI/CD flaw

GitLab has released patches for a critical vulnerability rated CVSS 10.0 that could allow an unauthenticated user to execute arbitrary code on a self-managed GitLab server.¹²

What we know

The flaw, tracked as CVE-2026-97229, is an integer overflow in GitLab’s CI/CD regular-expression compiler. GitLab says a specially crafted regular expression in a CI/CD configuration could allow arbitrary code execution because of insufficient validation.¹²

The affected ranges are GitLab 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. GitLab has released those three patched versions and strongly recommends that self-managed installations upgrade immediately.¹

GitLab’s patch release also addresses three other high-severity issues, including cross-site scripting, improper authorisation in downstream pipeline creation and a permissive regular-expression vulnerability that could poison cached repository responses.¹ GitLab.com is already running a patched version, while GitLab Dedicated customers do not need to take action, according to the company.¹

Our opinion

A maximum-severity flaw in the CI/CD path deserves fast attention because it sits close to the automation that builds and deploys software. The practical message is refreshingly clear: self-managed administrators should check their version and upgrade rather than wait for a detailed public exploit write-up. GitLab has not yet published full vulnerability details, saying security issues become public 90 days after the release in which they are fixed.¹

Sources

GitLab’s official patch notice provides the affected versions, remediation advice and vulnerability list. The Hacker News report adds the CVE summary and unauthenticated-code-execution context.¹²