Vulnerabilities · 1h ago
GitLab on 12 October released emergency patches for 24 vulnerabilities in Community Edition and Enterprise Edition, led by CVE-2026-97229, a CVSS 10.0 flaw in the CI/CD regular expression compiler that can let an unauthenticated attacker execute code on self-managed servers before 19.4.2, 19.3.4, and 19.2.8. The same release also closes other pipeline and variable-related issues.
The bug is in how GitLab checks regular expressions inside CI/CD configuration: a specially crafted pattern can trigger an integer overflow and make the server run code instead of treating the text as harmless build logic. That matters because the trust boundary is the pipeline definition itself, not just user login.
For teams that run GitLab as a developer control plane, the exposure sits on the server and can extend beyond one malicious config file to pipeline tampering and sensitive CI/CD data. Cloud-hosted GitLab is outside this specific advisory, but self-managed instances keep the risk until the fixed release is in place.
6 sources covering this story
GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code
GitLab fixed CVE-2026-97229 (CVSS 10.0), a CI/CD flaw that could allow unauthenticated code execution under certain conditions.
Múltiples vulnerabilidades en productos de GitLab
Distintos investigadores y miembros del equipo interno de GitLab han informado sobre 24 vulnerabilidad
GitLab fixes serious vulnerability that exposed software environments to sabotage
The company urged customers to upgrade to the latest versions of its flagship products.
GitLab warns of max severity code execution vulnerability
GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances.
Risolte vulnerabilità su GitLab CE/EE
Rilasciati aggiornamenti di sicurezza che risolvono 24 vulnerabilità, di cui 1 con gravità “critica” e 5 con gravità “alta”, in GitLab Community Edition (CE) ed Enterprise Edition (EE).
Part of the PlainSec briefing for 2026-10-13