In gymnastics, a perfect 10 gets you a gold medal. In vulnerability scoring, it gets you an emergency maintenance window and an inbox full of alarmed Slack messages. GitLab just got the second kind.
One Regex Can Take Over the Server
GitLab has patched CVE-2026-97229, a CVSS 10.0 flaw that it describes as an integer overflow in its CI/CD regular expression compiler. A specially crafted regex in a CI/CD configuration can lead to arbitrary code execution on the server. The CVSS vector lists no privileges required and no user interaction.
The bug affects self-managed Community and Enterprise Edition installations from version 19.1 onward. Fixes are in versions 19.4.2, 19.3.4, and 19.2.8, part of a release that addressed 24 vulnerabilities in total. GitLab.com already runs the patched code, and GitLab Dedicated customers don't need to do anything. Self-managed admins are being told to upgrade immediately.
Your CI Server Holds Every Key
A CI/CD server isn't just another box in the rack. It holds deploy keys, cloud credentials, signing secrets, and the power to ship code straight to production. If an attacker controls the build server, they can quietly change what your customers download. That is the supply-chain attack in a nutshell.
Two details are worth noting. GitLab says it hasn't seen exploitation in the wild, and Rapid7 reports that it reproduced code execution on an unpatched official GitLab CE image. So this is a working exploit, not a theoretical one. The update also includes database migrations, which means downtime for single-node installs. That's an awkward thing to schedule, but it's much better than spending your weekend on incident response.
Infrastructure you host yourself is infrastructure you have to patch yourself. If your self-managed GitLab hasn't been updated recently, today is the day.
If this has you rethinking how much trust your build pipeline gets by default, our free developer security checklist for defending against supply-chain attacks is a good place to start.
Source: Cyber Kendra