NewsEditorialSource: Rapid7
GitLab patches maximum-severity CI/CD code-execution vulnerability
GitLab released critical security updates on October 12, 2026, addressing CVE-2026-97229, a maximum-severity flaw in continuous integration and delivery (CI/CD) configuration handling. [1] GitLab says insufficient regular-expression validation can allow arbitrary server-side code execution under certain conditions in Community Edition and Enterprise Edition. [1] The vulnerability scores 10.0 on the Common Vulnerability Scoring System, version 3.1. [1] GitLab’s current fixed versions are 19.2.8, 19.3.5 and 19.4.2. [1] Rapid7 reported reproducing command execution on Community Edition 19.4.1; the same input failed on Community Edition 19.4.2. [2]
Why it matters
Self-managed operators on affected 19.2, 19.3 and 19.4 releases should upgrade immediately; GitLab says GitLab.com is patched and GitLab Dedicated customers need no action. [1] For the 19.3 branch, use GitLab’s current 19.3.5 target; BleepingComputer’s earlier report listed 19.3.4. [1][3] Despite the unauthenticated rating, Rapid7’s demonstrated attack required planting malicious CI/CD configuration and a UTF-8 repository path in a public project, so deployment conditions matter. [2] Rapid7 reported no confirmed exploitation in the wild as of October 13, 2026; that does not establish that no attacks occurred. [2]
Attribution
Sources
- 1Rapid7CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLabSource published (UTC)
- 2GitLabGitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8Source published (UTC)
- 3BleepingComputerGitLab warns of max severity code execution vulnerabilitySource published (UTC)
Read the original source for full details and context.