GitLab Patches Critical CVSS 10.0 Code Execution Flaw

GitLab has released emergency security updates for a critical vulnerability in its continuous integration and continuous delivery (CI/CD) system that could allow attackers to execute arbitrary code on affected servers. Tracked as CVE-2026-97229, the flaw carries a CVSS score of 10.0, the highest possible rating.

The vulnerability affects GitLab Community Edition (CE) and Enterprise Edition (EE). It stems from an integer overflow in the CI/CD regular-expression compiler, where insufficient validation of specially crafted expressions could allow code execution under certain conditions.

GitLab released the fixes on October 12, 2026, and recommends that administrators of self-managed installations upgrade immediately.

Which GitLab Versions Are Affected?

The vulnerability affects the following releases:

• GitLab 19.2 versions earlier than 19.2.8

• GitLab 19.3 versions earlier than 19.3.5

• GitLab 19.4 versions earlier than 19.4.2

Administrators should install the corresponding patched version for their release branch. The updates address other security issues as well, making it important to review the full patch release rather than focus exclusively on the critical vulnerability.

GitLab.com is already running a patched version, while GitLab Dedicated customers do not need to take action, according to the company's security advisory.

How the Vulnerability Could Be Exploited

CVE-2026-97229 involves the processing of a specially crafted regular expression in a CI/CD configuration. If successfully exploited, the flaw could allow an attacker to execute code on the GitLab server, potentially threatening the confidentiality, integrity and availability of systems and data.

Although the vulnerability's published severity assessment indicates that authentication is not required, practical exploitation has an important condition. Security researchers at Rapid7 reproduced code execution on an unpatched GitLab installation but found that an attacker must first be able to introduce a malicious CI/CD configuration into a repository. The researchers identified public-project configurations as one possible route under certain conditions.

The distinction matters because the CVSS rating describes the vulnerability's assessed characteristics, while the ability to exploit it in a real environment depends on the available attack path and deployment settings.

Administrators Urged to Patch Immediately

GitLab credited the researcher using the handle joaxcar with reporting the flaw through its HackerOne bug bounty programme.

Rapid7 confirmed that its test input worked against an unpatched GitLab CE 19.4.1 image but not against the patched 19.4.2 release. As of October 13, the researchers had not confirmed exploitation of this vulnerability in real-world attacks.

Organisations should prioritise patching affected self-managed installations, review their CI/CD configuration and access controls, and investigate suspicious activity where appropriate. The vulnerability demonstrates how a weakness in a development platform can put the infrastructure responsible for building and delivering software at risk.