GitLab patches a ten-out-of-ten bug in pipeline regex

GitLab shipped a critical patch release on 12 October — versions 19.4.2, 19.3.5 and 19.2.8 of Community Edition and Enterprise Edition — and told every self-managed installation to upgrade immediately. GitLab.com already runs the fixed code, and GitLab Dedicated customers need do nothing.

The reason for the urgency is CVE-2026-97229, rated CVSS 10.0. It is an integer overflow in the CI/CD Regular Expression Compiler, the component that parses and evaluates regular expressions in pipeline configuration. Because that validation was insufficient, an unauthenticated user could, under certain conditions, run arbitrary code on the GitLab server through a crafted regular expression in a CI/CD configuration. Affected are all versions from 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. The researcher known as joaxcar reported it through GitLab's HackerOne programme.

It is not the only fix in the release. GitLab lists 24 issues: one critical, five high, fourteen medium and four low. The high-severity ones include:

• Cross-site scripting in syntax-highlighted output, CVSS 8.7.
• A user with the Developer role running pipelines on protected branches through the downstream pipeline creation service, CVSS 8.5.
• Poisoned cached responses for raw repository files that could feed crafted content to other users' pipelines and expose protected variables, CVSS 8.2.
• Injected content in GitLab Duo Agent Platform instructions causing commands to be attributed to other users, CVSS 7.3.

One practical note for administrators: the 19.3 line goes straight to 19.3.5, because 19.3.4 broke merge request pages when the Ona integration was enabled. GitLab makes the detailed issue reports public 90 days after a fix ships.