CONFIRMED: GitLab released fixes on 12 October 2026 and says all self-managed installations should upgrade immediately. GitLab.com is already patched. No exploitation has been reported.
GitLab has released a critical patch for CVE-2026-97229, a flaw with the maximum CVSS score of 10.0 in GitLab Community Edition (CE) and Enterprise Edition (EE) [1]. GitLab published versions 19.4.2, 19.3.4 and 19.2.8 on 12 October 2026 [1].
What the flaw is
GitLab says the issue “could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation” [1].
GitLab lists it as an “Integer Overflow issue in CI/CD Regular Expression Compiler” and rates it Critical [1]. In plain terms: CI/CD configuration files tell GitLab how to build and test code automatically, and a regular expression is a text-matching pattern. A specially crafted pattern could, under certain conditions, let someone without an account run their own code on the server.
Who is affected
Affected versions, in GitLab’s words: “all versions from 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2” [1].
What to do
“We strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately,” GitLab says. “GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.” [1]
Self-managed means an organisation runs GitLab on its own servers. GitLab warns that the patch includes database migrations, so single-node instances will have downtime during the upgrade; multi-node instances can upgrade without downtime using its zero-downtime procedure [1]. It also notes a known bug in 19.3.4 affecting merge request pages when the Ona integration is enabled, with a fix to follow in 19.3.5 [1].
GitLab has not reported any exploitation of CVE-2026-97229 [1][2].
Who found it
GitLab credits the researcher joaxcar, who reported the flaw through GitLab’s HackerOne bug bounty programme [1][2].
24 security fixes in the release
The release’s table lists 24 security fixes [1]. Among them is CVE-2026-96893, a high-severity (CVSS 7.3) prompt-injection issue in the GitLab Duo Agent Platform, GitLab’s AI agent feature. GitLab says it “could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing unintended command execution attributed to other users” [1]. It was found internally by GitLab team member Mert Coskuner [1].
Sources
- GitLab, “GitLab Critical Patch Release: 19.4.2, 19.3.4, 19.2.8”, 12 October 2026. https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
- BleepingComputer (Sergiu Gatlan), “GitLab warns of max severity code execution vulnerability”, 12 October 2026. https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/
Related stories
- SonicWall Attack Attempts, a $1.26m Pwn2Own and a Windows Update Deadline
- Fireworks AI Confirms Misuse of Internal Credentials and Capture of Customers’ Stored API Keys and Tokens; It Reports No Evidence So Far of Wider Data Access
- Tencent Cloud Open-Sources TeamAI, a Git-Based “Team Harness” for AI Coding Agents
