GitLab

GitLab Races to Patch CVSS 10.0 Flaw That Let Unauthenticated Attackers Run Server Code

GitLab has shipped emergency patches for CVE-2026-97229, a maximum-severity CVSS 10.0 flaw in its CI/CD regular expression compiler that could allow unauthenticated remote code execution on self-managed servers. Rapid7 has independently confirmed working exploitation, making urgent upgrades essential.