GitLab urges immediate patching for critical remote code execution flaw

First reported by BleepingComputer at · Updated · 2 sources

BleepingComputer reports that the vulnerability lies in GitLab’s CI/CD Regular Expression Compiler and could let remote attackers run arbitrary code. According to Cyber Security News, CVE-2026-97229 requires no login, carries a CVSS score of 10.0 and affects both Community Edition and Enterprise Edition.

  • Cyber Security News reports that GitLab released patches on October 12, 2026.

Covered by 2 publishers within 1 hour of the first report.

Reporting2

BleepingComputer GitLab warns of max severity code execution vulnerability · Sergiu Gatlan
Cyber Security News Critical GitLab Vulnerability Enables Arbitrary Code Execution Attacks on Servers · Guru Baran

Related

LMCache flaw allows attackers to run remote code without logging in