GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code

GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result in arbitrary code execution.

"GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation," the company said in a Monday advisory.

The flaw, tracked as CVE-2026-97229 , has been described as an integer overflow issue. It carries a CVSS score of 10.0. It affects the following versions -

Patches for the flaw are available in versions 19.4.2, 19.3.5, and 19.2.8. Also addressed are three high-severity bugs -

The disclosure comes weeks after it remediated a critical flaw in AI Gateway ( CVE-2026-90970 , CVSS score: 9.9) that could have allowed an authenticated user with Duo Agent Platform access to break out of the prompt template sandbox via a specially crafted flow configuration and achieve arbitrary command execution on the AI Gateway.

Last month, another maximum-severity security flaw in GitLab CE and EE ( CVE-2026-85706 , CVSS score: 10.0) witnessed in-the-wild probes within hours of public disclosure.