GitLab Patches Critical Code-Execution Vulnerability

GitLab has released security updates for a critical vulnerability that could let an unauthenticated attacker execute code on affected servers, urging administrators of self-managed installations to upgrade. The company rated the flaw, CVE-2026-97229, 10.0, the maximum score on the Common Vulnerability Scoring System. GitLab says the vulnerability stems from an integer overflow in its continuous integration and continuous delivery (CI/CD) regular-expression compiler. Insufficient validation could, under certain conditions, allow an attacker to trigger code execution with a specially crafted expression in a CI/CD configuration. The issue affects both GitLab Community Edition and Enterprise Edition. The company released patched versions 19.4.2, 19.3.5 and 19.2.8 on October 12, 2026. GitLab recommends that administrators of affected self-managed installations upgrade to the corresponding fixed version. It says GitLab.com has been patched and GitLab Dedicated customers do not need to take action. Reports differ on whether GitLab 19.3.4 is affected. GitLab’s advisory was described as listing versions before 19.3.