Critical GitLab Vulnerability Enables Arbitrary Code Execution Attacks on Servers

GitLab has released urgent security updates to fix a critical vulnerability that could allow attackers to execute arbitrary code on affected servers without logging in. Tracked as CVE-2026-97229, the flaw carries the maximum CVSS score of 10.0 and affects both GitLab Community Edition and Enterprise Edition. The company released patches on October 12, 2026. The vulnerability involves an integer overflow in GitLab’s CI/CD regular expression compiler. GitLab says insufficient regular expression validation could allow an unauthenticated attacker to trigger code execution through a specially crafted expression inside a CI/CD configuration. Regular expressions are text patterns used to match or filter data. Here, processing a malicious...

Læs hele artiklen hos kilden.