GitLab warns of critical flaw with maximum score
An unauthenticated user could execute code on the GitLab server under certain conditions.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
GitLab has released security updates following the discovery of a critical vulnerability in its software. The flaw received a CVSS score of 10.0, the highest severity category on that scale.
The vulnerability lies in the compiler that processes regular expressions for CI/CD configurations. According to GitLab, an attacker could, under certain conditions, execute arbitrary code on the GitLab server using a specially crafted regular expression, without logging in first.
The flaw is registered as CVE-2026-97229. The vulnerability affects self-managed installations of GitLab Community Edition and Enterprise Edition. GitLab identifies versions 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2 as affected series.
GitLab released versions 19.4.2, 19.3.5 and 19.2.8 on 12 October. The company advises administrators of affected installations to upgrade as soon as possible. According to the supplier, GitLab.com is already running a patched version; GitLab Dedicated customers would not need to take action.
The flaw is particularly relevant to organisations that manage their own GitLab environment and use it to build or test software. CI/CD systems often have access to source code, build environments, secret keys and deployment processes. A vulnerability in such an environment can therefore have consequences extending beyond a single web application.
There is no confirmation that this specific vulnerability has already been exploited in the wild. Rapid7 writes that there was no known confirmed exploitation at the time of publication. This does not lessen the urgency for administrators, because the vulnerability can be attacked without an account and the potential impact is substantial.
The report also shows why software suppliers sometimes release security updates outside their normal release schedule. Alongside this critical flaw, GitLab fixed several other problems in the same versions, including issues involving authorisation, cross-site scripting and the GitLab Duo Agent Platform. Organisations should therefore not only check the version, but also determine whether suspicious activity is visible in logs.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The article is based on a primary security notice from GitLab and an independent technical analysis. The text clearly distinguishes between proven technical impact and unconfirmed exploitation in the wild.
- confirmed GitLab released versions 19.4.2, 19.3.5 and 19.2.8 on 12 October. — Mentioned in the official patch notice. source
- confirmed CVE-2026-97229 has a CVSS score of 10.0. — GitLab states the score in the vulnerability description. source
- confirmed An unauthenticated user could, under certain conditions, execute arbitrary code via a specially crafted regular expression. — Description by GitLab and Rapid7. source
- confirmed The affected versions are 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. — Official list of affected versions. source
- confirmed There was no confirmed exploitation in the wild at the time of the technical analysis. — Rapid7 writes that no confirmed exploitation was known. source
Editor's note
The vulnerability, affected versions, patched versions and CVSS score were confirmed by GitLab. Exploitation in the wild has not been confirmed and is therefore not presented as fact.Sources
More on this in Dutch media
- Het Parool — „gitlab cybersecurity”
- NRC — „gitlab cybersecurity”
- Tweakers — „gitlab cybersecurity”