Git Lab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code
Summary: GitLab released patches for CVE-2026-97229, a CVSS 10.0 integer overflow flaw that could let an unauthenticated user execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration, which GitLab attributed to insufficient regular expression validation. Fixes are available in versions 19.4.2, 19.3.5, and 19.2.8, and the advisory also addressed three high-severity bugs.
What's compelling: The flaw needs no credentials and no user action beyond a crafted CI/CD configuration, so any GitLab instance reachable by outsiders is exposed until patched. GitLab's prior CVSS 10.0 flaw drew in-the-wild probes within hours of public disclosure.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-85706CVE-2026-90970CVE-2026-97229
- Related
- CISA Adds Two Known Exploited Vulnerabilities to Catalog Cyber Risks · Oct 29, 2026CVE-2026-97229: Git Lab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability Known Exploited Vulnerabilities · Oct 29, 2026CVE-2026-85706: Git Lab Community Edition and Enterprise Edition Path Traversal Vulnerability Known Exploited Vulnerabilities · Sep 11, 2026