GitLab patches CVSS 10.0 flaw allowing unauthenticated remote code execution

GitLab released versions 19.4.2, 19.3.4 and 19.2.8 to fix CVE-2026-97229, an integer overflow in its CI/CD regex compiler rated CVSS 10.0. An unauthenticated attacker can execute arbitrary code on a GitLab server if they can commit a malicious .gitlab-ci.yml to a public project.

• CVE-2026-97229 carries the maximum CVSS score of 10.0
• Fixes shipped October 12 in versions 19.4.2, 19.3.4 and 19.2.8
• Rapid7 reproduced RCE on CE 19.4.1; the patch blocks it
• Exploitation requires committing a malicious .gitlab-ci.yml to a public project