GitLab Patches CVSS 10.0 Code Execution Flaw in CI/CD Regex Compiler
Security / news
GitLab Patches CVSS 10.0 Code Execution Flaw in CI/CD Regex Compiler
The Oct. 12 release fixes 24 vulnerabilities, and the third-party coverage of it names a fixed 19.3 version that GitLab's own patch page has since replaced.
An unauthenticated attacker with network access to a self-managed GitLab server can run arbitrary code on it by getting a crafted regular expression into CI/CD configuration, according to the advisory for CVE-2026-97229. GitLab rates the integer overflow 10.0 out of 10 on the CVSS severity scale and shipped fixes on Oct. 12 in versions 19.4.2, 19.3.5 and 19.2.8.
The mitigation is the upgrade. GitLab.com already runs patched code, and GitLab Dedicated customers need to do nothing, the company said on its patch release page. Self-managed Community and Enterprise Edition installations are the exposed population.
What the CVSS 10.0 vector says
The vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: reachable over the network, low complexity, no privileges, no user interaction, and a changed scope. The score overstates the risk for any instance that cannot be reached by an untrusted party, because the no-privileges and no-interaction terms assume an attacker can already send input to the server. It does not overstate the risk for an internet-facing instance, where those preconditions cost the attacker nothing.
GitLab said the code execution happens "under certain conditions", according to BleepingComputer, which reported the flaw on Oct. 12. Neither page says what those conditions are. The researcher credited on the advisory, the HackerOne user joaxcar, reported it through GitLab's bug bounty program.
Which version fixes it, and which sources have it wrong
BleepingComputer lists the fixed 19.3 release as 19.3.4. GitLab's patch page, titled for 19.4.2, 19.3.5 and 19.2.8, says a bug in 19.3.4 broke merge request pages when the Ona integration was enabled, and that 19.3.5 fixes it. The affected range on the advisory table reads "19.3 before 19.3.5". Operators on the 19.3 branch should target 19.3.5, not the number in the news coverage.
The page does not say whether anyone is exploiting CVE-2026-97229. BleepingComputer reported no known exploitation. GitLab's page says security issue details become public 90 days after the release.
The other 23 fixes in the same release
The release carries 24 security fixes in total. The regex bug is the only critical one.
- Critical1 fixes
- High5 fixes
- Medium14 fixes
- Low4 fixes
Source: GitLab patch release page, accessed 2026-10-14
The five high-severity entries are worth reading alongside the headline bug, because several need only a low-privilege account.
| CVE | Issue | CVSS 3.1 |
|---|---|---|
| CVE-2026-97229 | Regex compiler integer overflow, code execution | 10.0 |
| CVE-2026-92883 | Stored XSS through syntax highlighting of a crafted repository | 8.7 |
| CVE-2026-16301 | A Developer can run downstream pipelines on protected branches | 8.5 |
| CVE-2026-14814 | Poisoned cached raw files can expose protected variables | 8.2 |
| CVE-2026-81839 | Transferred project keeps pipeline privileges of the new group (EE only) | 7.7 |
| CVE-2026-96893 | Prompt injection into GitLab Duo Agent Platform agents (EE only) | 7.3 |
The last row is a prompt injection that lets a user plant instructions in GitLab Duo Agent Platform agents, causing actions attributed to other users. The vector requires a user to interact, and it applies to Enterprise Edition 19.1 and later.
Why GitLab operators are on a short clock
This is the second maximum-severity GitLab flaw in about a month. BleepingComputer said CVE-2026-85706, a path traversal that lets unauthenticated attackers read credentials and secrets, was added to CISA's exploited-vulnerabilities catalog one day after its disclosure, with federal agencies ordered to patch within three days. It also counted five GitLab flaws that CISA has flagged as exploited since November 2021, one of them used by ransomware gangs.
Patching is also not free. GitLab warned that the release includes database migrations, so single-node instances should expect downtime while migrations finish. Multi-node instances can use the zero-downtime upgrade procedure. Operators are also working through the Docker Hub token flaw and the October Patch Tuesday fixes covered earlier.
The first date to watch is 90 days after Oct. 12, when GitLab will publish the issue details for all 24 fixes.
Sources
More in Security
- 01PyPI Wheels Carry Binaries Nobody Can Tie to Their SourcePython developer Artem Golubin argues that clean source can ship beside a malicious wheel, and the May 2026 TanStack incident shows a valid signature does not settle it.
- 02Microsoft Fixes 1,411 Flaws in October Patch Tuesday, One ExploitedThe Oct. 13 release is a record by BleepingComputer’s count, but three trackers report three different totals and the exploited bug needs a user to open a file.
- 03Broadcom Wi-Fi Bug Has No CVE and No Patch on Belgian GatewaysResearcher Quentin Kaiser says a WPS overflow in Broadcom’s SDK dates to at least 2010 and lets an attacker in radio range run code without the network key.
- 04Palo Alto Patches PAN-OS CVE-2026-0322 as Attackers Reach Management InterfacesThe flaw gives an authenticated administrator root on the firewall. Palo Alto lists no workaround, and CISA gave federal agencies three days.