GitLab Fixes Critical Vulnerability Allowing Unauthenticated Code Execution

GitLab has fixed a critical security flaw that could allow attackers to run arbitrary code on its servers without logging in. The vulnerability, tracked as CVE-2026-97229, carries a maximum CVSS score of 10.0. Security Affairs and CSO Online confirm the severity level allows unauthenticated exploitation.

GitLab released patched versions for its Community Edition and Enterprise Edition on October 12. Versions 19.4 before 19.4.2, 19.3 before 19.3.5, and 19.2 before 19.2.8 are affected. Help Net Security and CSO Online note that GitLab.com already runs the update while self-managed users must upgrade immediately.

The flaw is an integer overflow in the CI/CD regular expression compiler caused by insufficient validation of input. CSO Online explains this weakness allows specially crafted expressions to bypass safety checks during configuration processing. GitLab Advisory states the issue could allow code execution under certain conditions.

While the vulnerability score indicates remote exploitation without privileges, researchers tested specific requirements for success. Rapid7 found that an attacker must commit a malicious file to a public project branch with UTF-8 characters to trigger the bug. Help Net Security reports no confirmed in-the-wild exploitation as of the current week.

The patch release also addresses five other high-severity bugs alongside the critical flaw. CSO Online details these include an authorization issue letting developers bypass security permissions and a cross-site scripting risk. One vulnerability allows attackers to inject crafted content into AI agent instructions.

GitLab credited a researcher for reporting the main flaw through its HackerOne bug bounty program. CSO Online attributes the find to Johan Carlsson while other reports name a handle known as joaxcar. All sources agree the disclosure followed responsible coordination with the vendor.

Major organizations including NVIDIA and Lockheed Martin rely on GitLab for software development workloads. Cybersecurity Dive notes hackers have used at least five vulnerabilities in attacks since 2021. The CISA agency monitors the situation but had not yet added this flaw to its official catalog as of Monday morning.