GitLab patches a max-severity regex flaw alongside five high-severity bugs
GitLab patched unauthenticated CI/CD regex RCE CVE-2026-97229 (CVSS 10) and five high-severity flaws.
GitLab released Community and Enterprise Edition versions 19.4.2, 19.3.5, and 19.2.8 fixing CVE-2026-97229, an integer overflow in the CI/CD regular-expression compiler scored CVSS 10.0. A crafted regular expression in CI/CD configuration could let an unauthenticated attacker execute arbitrary code on the server. Five high-severity issues include stored XSS (CVE-2026-92883, 8.7), unauthorized protected-branch pipelines (CVE-2026-16301, 8.5), cache poisoning of raw files (CVE-2026-14814, 8.2), pipelines after project transfer (CVE-2026-81839, 7.7), and GitLab Duo agent-instruction injection (CVE-2026-96893, 7.3). GitLab.com is already patched, Dedicated customers need no action, and self-managed administrators are urged to upgrade immediately.