GitLab emergency patch closes a code execution hole
GitLab on 12 October released emergency patches for 24 vulnerabilities in Community Edition and Enterprise Edition, led by CVE-2026-97229, a CVSS 10.0 flaw in the CI/CD regular expression compiler that can let an unauthenticated attacker execute code on self-managed servers before 19.4.2, 19.3.4, and 19.2.8. The same release also closes other pipeline and variable-related issues.
The bug is in how GitLab checks regular expressions inside CI/CD configuration: a specially crafted pattern can trigger an integer overflow and make the server run code instead of treating the text as harmless build logic. That matters because the trust boundary is the pipeline definition itself, not just user login.
For teams that run GitLab as a developer control plane, the exposure sits on the server and can extend beyond one malicious config file to pipeline tampering and sensitive CI/CD data. Cloud-hosted GitLab is outside this specific advisory, but self-managed instances keep the risk until the fixed release is in place.
GitLab heeft kwetsbaarheden verholpen in GitLab Community Edition (CE) en Enterprise Edition (EE), specifiek in versies voorafgaand aan 19.2.8, 19.3.5 en 19.4.2.