GitLab pushed out a fix on Monday for its worst-rated bug of the year: CVE-2026-97229, an integer overflow in the regular expression compiler that sits inside its CI/CD pipeline. The vendor scored it 10.0.
The flaw is remote, low-complexity, and needs no account or user interaction. A specially crafted expression placed in a CI/CD configuration could hand an anonymous visitor code execution on the server.
Who needs to move
Patched builds are 19.2.8, 19.3.5 and 19.4.2 for both Community and Enterprise editions. Every release from 19.2 up to those points is exposed. GitLab told anyone running a self-managed instance to upgrade straight away, because the fix also carries unrelated bug and security repairs.
Teams on gitlab.com are already covered, and Dedicated customers have nothing to do.
The researcher credited through HackerOne is Johan Carlsson, who also reported a medium-severity open redirect in GitLab’s Kubernetes proxy, CVE-2026-7767, that can leak authentication tokens to the wrong host.
Monday’s release bundles five more high-severity repairs. One covers protected environment variables, another lets a logged-in user run script in other people’s browser sessions, and a third concerns tampering with the instructions handed to AI agents. Attackers have abused at least five GitLab flaws since 2021, so exploitation of this one is worth watching.
