Maximum severity: GitLab fixes flaw rated CVSS 10
Crafted regular expressions let attackers run code on GitLab servers without logging in. Administrators of self-managed instances are urged to update immediately.
Graphic: TERRA WORLD NEWS (own graphic based on the sources listed)
Developer platform GitLab has patched a security flaw rated at the maximum severity score of 10.0. According to the vendor, the bug, tracked as CVE-2026-97229, sits in the component that processes regular expressions in CI/CD configurations. A specially crafted expression could trigger an integer overflow. Attackers needed neither credentials nor user interaction: network access to a vulnerable instance was enough to run their own code on the server.
The Community and Enterprise editions in the 19.2, 19.3 and 19.4 release lines are affected. Versions 19.2.8, 19.3.5 and 19.4.2, released on Oct. 12, fix the problem. GitLab.com is already patched, and Dedicated customers need take no action. The advisory reports no active exploitation so far, and no public proof-of-concept was initially known.
The update fixes 24 vulnerabilities in total: one critical, five high, 14 medium and four low. GitLab urges all administrators of self-managed servers to upgrade immediately. On single-node installations the database migrations require brief downtime, which properly planned multi-node upgrades can avoid.