GITLAB PATCHES CVSS 10.0 FLAW THAT COULD LET UNAUTHENTICATED USERS RUN SERVER CODE

Summary from the TLDR InfoSec newsletter

GitLab fixed CVE-2026-97229, a CVSS 10.0 integer overflow vulnerability in regex validation for CI/CD configurations. In certain conditions, an unauthenticated user could execute arbitrary code on a GitLab server. The fixes are included in CE/EE versions 19.2.8, 19.3.5, and 19.4.2. The release also addresses high-severity XSS, authorization, and response-cache poisoning vulnerabilities.