GitLab patches CVSS 10 remote code flaw in its CI/CD regex compiler

GitLab patches CVSS 10 remote code flaw in its CI/CD regex compiler

12 October 2026: GitLab has fixed CVE-2026-97229, a critical integer overflow in the CI/CD Regular Expression Compiler that scores 10.0 on the CVSS scale and could let an unauthenticated attacker run code on the server. The fix is in GitLab Community and Enterprise Editions 19.4.2, 19.3.4 and 19.2.8. GitLab.com already runs the patched code, and GitLab Dedicated customers need to do nothing.

How a crafted regex becomes code execution

The compiler parses and evaluates the regular expressions that appear in pipeline configuration files. GitLab's advisory says insufficient validation of those expressions meant that, under certain conditions, an unauthenticated user could run arbitrary code on the GitLab server with a specially crafted regex in a CI/CD configuration. The vector string published with the advisory is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: reachable over the network, low complexity, no privileges, no user interaction, and a changed scope. The weakness is classed as an integer overflow. The reporter is a researcher using the handle joaxcar, who filed it through GitLab's HackerOne programme.

Neither GitLab's advisory nor BleepingComputer's report says the flaw has been exploited. That matters for sequencing, but not much: GitLab says it strongly recommends that all self-managed installations be upgraded immediately.

Fixed versions

Every release line from 19.2 onwards is affected until it reaches the patched build:

• 19.2 before 19.2.8: upgrade to 19.2.8
• 19.3 before 19.3.4: upgrade to 19.3.4
• 19.4 before 19.4.2: upgrade to 19.4.2

The advisory lists no workaround, so upgrading is the only documented remediation. Instances on older lines than 19.2 are not named in the advisory, and anyone running one should check GitLab's release documentation for their version rather than assume they are unaffected.

Twenty-three other fixes in the same release

The same patch release closes four more high-severity issues in Community and Enterprise Editions, plus a fifth in the Duo Agent Platform: cross-site scripting in syntax highlighting (CVSS 8.7), improper authorisation in downstream pipeline creation (8.5), a permissive regular expression in repository file access (8.2), and incorrect authorisation in the scheduled pipeline execution policy (7.7, Enterprise only). The Duo issue is a prompt-injection flaw rated 7.3. The remainder are medium and low issues, mostly authorisation gaps in the GraphQL API, package registry and import features.

Planning the upgrade window

GitLab warns that single-node instances will have downtime, because database migrations must finish before the application starts. Multi-node installations can follow the zero-downtime procedure instead. The 19.3.4 build carries post-deploy migrations that can run after the upgrade, and it has a known bug affecting merge request pages when the Ona integration is enabled; GitLab plans a fix in 19.3.5. Teams on the 19.3 line who use that integration may prefer to move to 19.4.2 directly.

A second maximum-severity GitLab flaw in a month

BleepingComputer notes that last month GitLab patched a maximum-severity path traversal flaw, CVE-2026-85706, that let unauthenticated attackers read sensitive data such as credentials. CISA added it to its Known Exploited Vulnerabilities catalogue the next day and gave federal agencies three days to patch. The same report counts five GitLab flaws that CISA has flagged as exploited since November 2021, one of which ransomware groups have used. Given that record, self-managed administrators should treat this release as urgent even without a report of attacks, and should review who can edit pipeline configuration files in their projects.

Related on TrustList:

• Apache fixes four Struts flaws, one of them OGNL code execution
• Fake "Security Audit" GitHub workflows now sweep git histories for keys
• GitHub Actions retires the macOS 14 runner image on 2 November 2026, with failing brownout windows from 5 October

Sources

• GitLab: Patch release GitLab 19.4.2, 19.3.4, 19.2.8 released, 12 October 2026
• BleepingComputer: GitLab warns of max severity code execution vulnerability, 12 October 2026