GitLab's CVSS 10 fix lives in the CI config parser
The server reads your CI configuration before any runner sees it. (Most of us forget that it gets parsed on the server at all.) On 12 October GitLab shipped critical patch releases 19.4.2, 19.3.5 and 19.2.8 for Community and Enterprise Edition, and the top fix sits in exactly that layer. CVE-2026-97229 is an integer overflow in the CI/CD regular expression compiler, rated CVSS 10.0. According to the advisory, under certain conditions an unauthenticated user could execute arbitrary code on the Gi
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.