GitLab patches a CVSS 10.0 unauthenticated RCE in self-managed instances
CVE-2026-97229 lets an unauthenticated attacker run code on a GitLab server through a crafted regular expression in the CI/CD compiler. GitLab.com is already patched.
GitLab shipped a critical patch release today, 19.4.2, 19.3.4 and 19.2.8 for both Community and Enterprise Edition, to fix CVE-2026-97229: an integer overflow in the CI/CD regular expression compiler, rated CVSS 10.0. GitLab’s own advisory says it lets “an unauthenticated user execute arbitrary code on the GitLab server via a specially crafted regular expression.”
The flaw affects self-managed instances on 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2. GitLab.com is already running the patched version, and Dedicated customers don’t need to act, but GitLab says every self-managed installation should upgrade immediately. The same release carries 24 further fixes, including a high-severity prompt injection bug in Duo Agent.
Why it matters: this is unauthenticated remote code execution on the server that runs your CI/CD pipelines and holds your source. If you run GitLab yourself rather than using GitLab.com, this is a patch-today situation, not a patch-this-sprint one.
The caveat: GitLab flags a known issue in 19.3.4 affecting merge request pages when the Ona integration is enabled, with a fix due in 19.3.5. Single-node deployments will see downtime during the upgrade.