GitLab Patches CVE-2026-97229 (CVSS 10.0) Flaw That Lets Unauthenticated Attackers Execute Arbitrary Code
Do Son 
TL;DR
GitLab released versions 19.4.2, 19.3.4 and 19.2.8 on October 8, 2026, fixing 24 security issues. The worst, CVE-2026-97229, is a GitLab critical vulnerability with a CVSS score of 10.0. It could let an unauthenticated attacker execute arbitrary code on the server.
See a GitLab CVE's exploit risk spike before it becomes a headline.
Get EPSS spike alertsWhy It Matters
GitLab servers hold source code, CI/CD secrets and deployment keys. A full server takeover would expose all of them. Moreover, this flaw needs no login, which puts any internet-facing instance at risk.
GitLab.com already runs the fix, and GitLab Dedicated customers need no action. Self-managed installations, however, must upgrade on their own.
How the Attack Works
The bug sits in the CI/CD regular expression compiler. According to the GitLab 19.4.2 patch release notes, weak validation of regular expressions leads to an integer overflow. A specially crafted expression in a CI/CD configuration can then trigger code execution.
This is the second fix in this component in two weeks. Public vulnerability databases list a related flaw, CVE-2026-93577 (CVSS 9.9), patched on September 24. That earlier bug required an authenticated user, whereas the new one does not.
Other high-severity fixes
- CVE-2026-92883 (CVSS 8.7): a cross-site scripting flaw in syntax highlighting. An authenticated user could run arbitrary JavaScript in other users’ browsers through a crafted repository.
- CVE-2026-16301 (CVSS 8.5): an authorization flaw that let a Developer run pipelines on protected branches without permission.
The release also fixes 21 other issues. These include a cache poisoning bug rated 8.2 that could expose protected CI/CD variables. Another flaw let users inject content into GitLab Duo Agent Platform prompts. Several GraphQL bugs let unauthenticated users read confidential notes on public projects.
Exploitation status
GitLab’s advisory does not report exploitation in the wild. Likewise, no public proof-of-concept has been confirmed. Researcher joaxcar reported the GitLab critical vulnerability through HackerOne.
Affected Versions
These flaws affects GitLab CE/EE:
- 19.1 before 19.2.8
- 19.3 before 19.3.4
- 19.4 before 19.4.2
Patch and Mitigation Steps
- Upgrade to 19.4.2, 19.3.4 or 19.2.8 right away.
- Prioritize instances reachable from the internet.
- Review recent CI/CD configuration changes for unexpected regular expressions.
- Rotate CI/CD secrets if you suspect any compromise.
GitLab will publish full issue details 90 days after the release. Until then, patching remains the only complete fix for this arbitrary code execution risk.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
