GitLab patches a maximum-severity flaw that could let unauthenticated attackers run code on its servers
CVE-2026-97229 is an integer overflow in the regular expression compiler used by GitLab's CI/CD system. It affects both Community and Enterprise editions, and GitLab is urging administrators of self-managed instances to upgrade.
Evidence: Official disclosure. Security stories run only with a named disclosure or independent reporting behind them.
GitLab has fixed a critical vulnerability, CVE-2026-97229, and is urging administrators of self-managed instances to install the patch. The flaw is an integer overflow in the regular expression compiler used by GitLab's CI/CD pipelines, and it affects both the Community and Enterprise editions. GitLab gave it a CVSS score of 10.0, the highest possible. According to the scoring details, it can be exploited remotely, with little effort, and without any privileges or user interaction. GitLab's advisory says that, under certain conditions, an unauthenticated user could have run arbitrary code on the server by placing a specially crafted regular expression in a CI/CD configuration, because those expressions were not checked closely enough. The fixes are in versions 19.4.2, 19.3.5 and 19.2.8, released on October 12, 2026. All versions from 19.2 before 19.2.8, from 19.3 before 19.3.5, and from 19.4 before 19.4.2 are affected. GitLab also said version 19.3.5 fixes a bug in 19.3.4 that affected merge request pages when the Ona integration was turned on. Because GitLab servers often hold source code and pipeline secrets, a flaw that allows code execution there puts development environments at risk.