GitLab patches a max-severity regex flaw alongside five high-severity bugs

What happened

The company released a fix on Monday, alongside patches for five other high-severity flaws affecting its source code management and continuous integration and delivery (CI/CD (the automated pipeline that tests and ships code changes)) platform. The company urged administrators of self-managed installations running affected versions to upgrade immediately.

GitLab.com is already running the patched version, while GitLab Dedicated customers do not need to take action, the company said in the advisory. GitLab just fixed a max-severity vulnerability that could allow unauthenticated attackers to execute arbitrary code on its servers.

The vulnerability, tracked as CVE-2026-97229 (the public catalogue number for a specific software flaw) , was fixed in versions 19.4.2, 19.3.5, and 19.2.8 of its Community Edition (CE) and Enterprise Edition (EE), according to a patch advisory . The release also addresses vulnerabilities that could expose protected environment variables, allow unauthorized pipeline execution, and enable attackers to inject crafted content into AI agent (AI that carries out multi-step tasks rather than answering one question) instructions.

Key facts

• The company — released: a fix on Monday, alongside patches for five other high-severity flaws affecting its source code management and continuous integration and delivery (CI/CD) platform