GitLab fixes CVSS 10.0 vulnerability: unauthenticated users can execute server code

GitLab fixes the most critical vulnerability CVE-2026-97229 with a CVSS score of 10.0: due to insufficient regex validation, unauthenticated users can execute arbitrary code on GitLab servers via specially crafted regular expressions in CI/CD configurations. Patches were released with 19.4.2, 19.3.5, and 19.2.8; earlier versions of 19.2, 19.3, and 19.4 are affected. The same update also fixes three high-severity vulnerabilities: CVE-2026-92883 (8.7, cross-site scripting), CVE-2026-16301 (8.5, improper downstream pipeline authorization), and CVE-2026-14814 (8.2).