GitLab patches a CVSS 10.0 CI/CD regex RCE — and five more high-severity flaws

On October 12, 2026, GitLab released CE/EE 19.4.2, 19.3.5 and 19.2.8. Its official advisory describes CVE-2026-97229, an integer overflow in the CI/CD Regular Expression Compiler that under certain conditions could permit unauthenticated remote arbitrary code execution through a crafted regular expression in pipeline configuration. GitLab rates it CVSS 10.0. The same patch addresses five high-severity issues, including protected-branch pipeline authorisation, poisoning of cached raw repository responses that pipelines consume, cross-site scripting in syntax highlighting, and an AI agent prompt-construction issue. GitLab says GitLab.com is already patched and GitLab Dedicated customers need no action.

Self-managed GitLab installations host source code, CI/CD runners, deployment credentials, protected variables and repository artifacts. A remotely reachable server-code-execution vulnerability therefore threatens not only the GitLab service but also the build and release chain it controls. The secondary pipeline and raw-file cache vulnerabilities independently reinforce the need to patch. Teams should treat the applicable patch as urgent, while distinguishing potential exploitability from confirmed exploitation.

GitLab says insufficient validation in its CI/CD Regular Expression Compiler allowed a specially crafted regex in CI/CD configuration to trigger an integer-overflow condition and, under certain circumstances, execute arbitrary code on the GitLab server without authentication. CVE-2026-97229 has a CVSS v3.1 score of 10.0. The official affected lines are GitLab 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. That is the vendor's scope for this CVE; it should not be expanded to every historical GitLab version without evidence.

CVE-2026-16301 (8.5) could allow a Developer-role user to execute pipelines on protected branches through downstream pipeline authorisation failures. CVE-2026-14814 (8.2) could allow poisoning of cached raw repository file responses, potentially causing targeted pipelines to run attacker-crafted content and expose protected environment variables. CVE-2026-92883 (8.7) is a cross-site scripting bug in syntax-highlighted repository content. Enterprise Edition also fixes a scheduled pipeline policy authorisation issue (CVE-2026-81839, 7.7) and a GitLab Duo Agent Platform prompt-construction weakness (CVE-2026-96893, 7.3). These are separate vulnerabilities, not demonstrated exploit chains.

GitLab explicitly notes that 19.3.4 introduced a bug affecting merge request pages when the Ona integration was enabled, and 19.3.5 corrects it. The October 12 advisory therefore recommends 19.4.2, 19.3.5 or 19.2.8, according to supported release line. GitLab.com is already patched, and GitLab Dedicated customers need no manual action. Self-managed operators should follow their deployment's documented upgrade path and verify the installed version after rollout.

Because a self-managed GitLab server can control CI/CD execution, packages and secrets, its compromise could have wider downstream consequences than a routine web-app outage. Review access controls and unexpected pipeline activity while planning the update, but do not mistake those precautions for a vendor-approved replacement for patching. The primary advisory says full vulnerability issue details are typically published 90 days after the patch; there is no verified public proof here of widespread active exploitation of this specific CVE.