GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code

GitLab patched an integer overflow vulnerability in its Community Edition and Enterprise Edition software. The flaw involved insufficient validation of regular expressions used in CI/CD configurations. It mattered because an unauthenticated user could potentially execute arbitrary code on the GitLab server without first signing in.

The affected ranges were all 19.2 versions before 19.2.8, all 19.3 versions before 19.3.5, and all 19.4 versions before 19.4.2. An attacker could submit a specially crafted regular expression in a CI/CD configuration. The article does not describe the exact exploit sequence, but links the vulnerability to inadequate regular-expression validation.

GitLab released fixes in versions 19.4.2, 19.3.5, and 19.2.8. The vulnerability is tracked as CVE-2026-97229 and carries a CVSS score of 10.0. The same release update also addressed three high-severity issues involving cross-site scripting, protected-branch pipelines, and poisoned cached repository responses.

Arbitrary code execution is the ability to make a computer run code chosen by an attacker. The code may perform actions that the affected application or server is allowed to perform. In GitLab’s case, the advisory says a specially crafted regular expression could allow code execution on the GitLab server.

The danger comes from control rather than from one specific outcome. If an attacker can run code, they may be able to read data, alter files, create processes, or interfere with services, depending on the system’s permissions. The article does not list every possible result of this flaw, so those consequences are general security implications rather than confirmed outcomes here.

This vulnerability received a CVSS score of 10.0, the highest score on that scale. It was also described as exploitable by an unauthenticated user, which makes the reported risk particularly serious. GitLab patched it in three supported release lines.

A regular expression is a pattern used to match or validate text. CI/CD configurations can use such patterns, and GitLab’s advisory says this vulnerability arose when a specially crafted expression passed through insufficient validation. The result could be arbitrary code execution on the GitLab server.

The article does not provide the exact payload or every processing step. It does establish the important path: an unauthenticated user supplied a malicious regular expression through a CI/CD configuration, GitLab failed to validate it safely under certain conditions, and the flaw could then be used to execute code. The vulnerability was also described as an integer overflow issue.

This matters because the attacker did not need an account, according to the advisory. GitLab patched the issue as CVE-2026-97229 in versions 19.4.2, 19.3.5, and 19.2.8. Older versions in the listed 19.2, 19.3, and 19.4 ranges were affected.

CVSS, the Common Vulnerability Scoring System, is a framework for rating vulnerability severity. A score of 10.0 is the maximum base score. It signals an exceptionally serious combination of attack conditions and potential impact, although the score is not itself a prediction of every real-world outcome.

CVSS generally measures exploitability factors such as whether the attacker needs network access, authentication, or user interaction. It also considers impact on confidentiality, integrity, and availability. Later CVSS metrics can account for changing conditions, such as whether a fix exists or whether exploitation is reported.

The article gives GitLab’s flaw a 10.0 score and describes it as exploitable by an unauthenticated user through a crafted CI/CD regular expression. It also identifies three other high-severity vulnerabilities, with scores of 8.7, 8.5, and 8.2. Those scores are serious but lower than the maximum rating.

The confirmed consequence is arbitrary code execution on the GitLab server. That could allow an attacker to perform actions available to the process running GitLab. The article does not specifically say that this flaw stole source code, changed pipelines, or exposed credentials, so those outcomes should not be treated as confirmed incidents.

In practice, server-side code execution can threaten source repositories, CI/CD configuration, pipeline jobs, and deployment connections when the compromised process can access them. It could also endanger credentials or environment variables stored for automation. The article separately reports that another vulnerability could expose protected environment variables, but it does not attribute that result to CVE-2026-97229.

The risk is therefore potentially broad, but the exact reach depends on permissions and system design. GitLab patched the maximum-severity issue in three release lines. Administrators should use the fixed versions and review related high-severity issues included in the same update.

Protected branches are security boundaries around important code branches. They can restrict who may push changes or run certain actions. This helps prevent unapproved code from entering release workflows. Developer permissions similarly define what an authenticated user can do, rather than treating every signed-in user as fully trusted.

Environment variables often carry settings or secrets used by CI/CD jobs. Limiting their exposure helps keep deployment credentials and other sensitive values away from unauthorized users or untrusted jobs. The article reports a vulnerability that could let a Developer run pipelines on protected branches, and another that could expose protected environment variables through poisoned cached responses.

These controls matter because CI/CD systems connect source code, automation, and deployment environments. Weak authorization can turn a modest account into a route toward protected operations. Weak secret isolation can expose values used by deployments. The article’s fixes address these boundaries alongside the maximum-severity code-execution flaw.

An integer overflow happens when an integer calculation produces a value outside the range that the stored number type can represent. The value may wrap around, become unexpectedly small, or otherwise differ from the intended result. That creates a mismatch between what software calculates and what it assumes.

Validation routines often calculate lengths, sizes, offsets, or limits before processing input. If an overflow corrupts one of those calculations, a check may approve input that is too large or malformed. In a regular-expression parser, that could undermine checks designed to constrain or safely handle a pattern. The article identifies GitLab’s vulnerability as an integer overflow tied to insufficient regular-expression validation, but does not provide the exact calculation.

The security impact depends on what happens after the incorrect value is used. In this case, GitLab said the flaw could allow arbitrary code execution under certain conditions. Patches were released in versions 19.4.2, 19.3.5, and 19.2.8.