GitLab admins urged to patch critical RCE flaw (CVE-2026-97229)

GitLab has released emergency fixes for a maximum-severity flaw, CVE-2026-97229, found in the regular expression compiler used by its CI/CD pipeline configuration. The bug, an integer overflow rated CVSS 10.0, could let an unauthenticated attacker run arbitrary code on a self-managed GitLab server simply by submitting a malicious regex inside a CI/CD config file. It impacts both GitLab Community Edition and Enterprise Edition across the 19.2, 19.3 and 19.4 release lines, and GitLab is telling every self-hosted admin to upgrade immediately to 19.4.2, 19.3.5 or 19.2.8, published on October 12, 2026. GitLab.com already runs patched code and Dedicated customers need not act, while the issue was disclosed through HackerOne by researcher joaxcar, who also flagged a separate medium-severity open-redirect bug (CVE-2026-7767) in GitLab's Kubernetes proxy.