GitLab’s Latest Security Flaw Scores an Unwelcome Perfect 10

When a vulnerability receives a CVSS score of 10.0, it is generally not the sort of perfect score anyone is hoping for.

GitLab has released security updates addressing CVE-2026-97229, a maximum-severity vulnerability affecting both its Community Edition and Enterprise Edition software.

Under certain conditions, the flaw could allow an unauthenticated attacker to execute arbitrary code on the GitLab server.

In simpler terms, someone may not need an account before causing potentially serious trouble.

What Is the Vulnerability?

The issue is linked to how GitLab handles specially crafted regular expressions within CI/CD configuration.

Insufficient validation could trigger an integer overflow and ultimately allow arbitrary code execution on the underlying server.

Affected releases include:

  • GitLab 19.2 versions before 19.2.8
  • GitLab 19.3 versions before 19.3.5
  • GitLab 19.4 versions before 19.4.2

Organisations running affected versions should upgrade to one of the fixed releases as soon as possible.

Three More Flaws Join the Patch List

GitLab’s security update also addresses three high-severity vulnerabilities.

These include a cross-site scripting flaw that could execute JavaScript in another user’s browser, an authorisation problem affecting protected CI/CD branches and a cache-poisoning weakness that could potentially expose protected environment variables.

GitLab has dealt with several serious vulnerabilities during 2026, including other flaws affecting its AI and CI/CD environments.

That makes prompt patching particularly important for organisations using GitLab as a central part of their development process.

Development platforms often contain source code, credentials, pipelines and deployment secrets, making them extremely attractive targets.

For administrators, the required action is refreshingly straightforward: check your GitLab version and patch it.

This is one occasion where ignoring the update notification and hoping for the best would be a particularly adventurous security strategy.