GitLab patched a maximum-severity bug in its CI regex compiler
On October 12, 2026, GitLab released 19.4.2, 19.3.5, and 19.2.8. CVE-2026-97229, scored 10.0, can let an unauthenticated user run code on a self-managed server through a crafted CI regular expression.