GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code

GitLab released patches addressing a maximum-severity integer overflow vulnerability (CVE-2026-97229, CVSS 10.0) that could enable unauthenticated arbitrary code execution via a specially crafted regular expression in CI/CD configurations; affected versions include all releases from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2, with fixes available in 19.2.8, 19.3.5, and 19.4.2. The advisory also fixes three high-severity issues (CVE-2026-92883, CVE-2026-16301, CVE-2026-14814) and references recent critical GitLab flaws and prior in-the-wild probes of other CVEs.