GitLab patched a maximum-severity bug in its CI regex compiler
On October 12, 2026, GitLab released 19.4.2, 19.3.5, and 19.2.8. CVE-2026-97229, scored 10.0, can let an unauthenticated user run code on a self-managed server through a crafted CI regular expression.
What was reported
GitLab's October 12, 2026 patch notes say CVE-2026-97229 is an integer overflow in the CI/CD regular expression compiler. Under certain conditions, an unauthenticated user could run arbitrary code on the server with a specially crafted regular expression in a CI/CD configuration, because regular expressions were not validated tightly enough. The score is CVSS 10.0. Affected ranges are 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.
The same release fixes other issues, including an authenticated cross-site scripting bug in syntax highlighting (CVE-2026-92883, CVSS 8.7) and an authorization bug that let a developer run pipelines on protected branches (CVE-2026-16301, CVSS 8.5). GitLab credits the reporters on the patch page.
Self-managed CI is part of the deploy path. A bug that runs code from a pipeline config is a bug in the system that ships the app.
How to prevent it
Upgrade self-managed GitLab Community Edition and Enterprise Edition to 19.4.2, 19.3.5, or 19.2.8. Do not stop on 19.3.4: GitLab says the fix line for this bug is 19.3.5, and that 19.3.4 still had a separate merge-request bug. GitLab says GitLab.com was already patched and Dedicated tenants were patched before this release was published.
Sources
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.