GitLab Patches Maximum-Severity Remote Code Execution Bug
GitLab released emergency security updates for CVE-2026-97229, a maximum-severity remote code execution vulnerability affecting its Community and Enterprise editions. The flaw has a CVSS score of 10.0 and could allow an unauthenticated remote attacker to execute arbitrary code on a vulnerable GitLab server under certain conditions. The vulnerability is reported to reside in GitLab's software.
GitLab issued emergency fixes for CVE-2026-97229, rated 10.0, affecting Community and Enterprise editions. The issue sits in the CI/CD regular-expression compiler, where inadequate checks on crafted patterns can permit unauthenticated code execution in some circumstances.
Patched releases 19.2.8, 19.3.4, and 19.4.2 arrived on October 12, 2026. Self-managed administrators were told to update promptly; GitLab.com already runs a fixed version, and GitLab Dedicated users need no extra steps.
Organizations running self-managed GitLab instances may face heightened risk, particularly software teams whose repositories and CI/CD pipelines hold credentials, deployment secrets, and production access. If exploited, the flaw could expose sensitive code or enable downstream supply-chain disruptions, affecting developers, customers, and service availability. GitLab.com and Dedicated users appear less exposed based on the vendor’s guidance, though security teams may still need to verify exposure and monitor for unusual activity.