GitLab on Oct. 12 patched a maximum-severity CVSS 10.0 flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software products that could result in arbitrary code execution.
Security teams were told by GitLab to patch right away. Researchers at Rapid7 on Oct. 13 posted a blog saying that although there’s been no confirmed exploitation in the wild, Rapid7 Intelligence independently reproduced arbitrary code execution on an unpatched, official GitLab CE image.
“Given the vulnerability’s maximum CVSS score, network-accessbile trigger, and code execution in a GitLab application worker, Rapid7 recommends upgrading affected self-managed instances on an urgent basis, outside of normal patch cycles,” wrote the Rapid7 team.
Roman Y. Sannikov, global research coordinator at iCounter, explained that a CVSS 10.0 in GitLab gets attackers’ attention fast because of what sits behind it: a self-managed GitLab server holds an organization’s source code, its build pipelines, and usually the credentials those pipelines use to reach cloud accounts, package registries and production.
Sannikov said code execution on that server gives an attacker a path into everything the company builds and ships and we saw with GitLab’s last 10.0 flaw that scanning started shortly after disclosure. Sannikov said once a patch becomes public, attackers can compare the fixed and unfixed versions to work out what changed, and AI tools now make that step much faster.
“Teams should assume the window between disclosure and exploitation is days, not weeks,” said Sannikov. “Patch every self-managed instance now, including the forgotten ones that dev teams stood up outside central IT. Then look at what a compromised instance could have reached: rotate CI/CD secrets and tokens, and review runner and pipeline activity since disclosure for anything unexpected.”
Shane Barney, chief information security officer at Keeper Security, added that when a flaw carries a maximum CVSS score of 10.0 and allows unauthenticated remote code execution, it demands immediate remediation. Barney said what makes CVE-2026-97229 particularly dangerous is its location: it resides in the CI/CD pipeline compiler, a system trusted to parse configurations, build software, and deploy code into production environments.
Barney said because exploitation requires no authentication and no user interaction, an attacker can use a specially crafted regular expression in a pipeline configuration file to execute arbitrary code directly on the underlying server. In practice, Barney said compromising a CI/CD engine gives threat actors a path into the software supply chain.
“From there, adversaries can exfiltrate source code, harvest embedded infrastructure secrets or inject malicious code downstream into production systems,” said Barney. “For organizations running self-managed instances of GitLab CE or EE, patching should happen immediately.”
Darin Fredde, offensive security leader at Ridge Security, said a CVSS 10.0 vulnerability deserves immediate attention, but the score alone isn't what concerns him: it’s the potential attack path. Fredde said when an unauthenticated attacker can execute code on a server, we've removed one of the first barriers an attacker would normally have to overcome.
Fredde added that a compromised GitLab instance can potentially become more than a single compromised server: it can deliver a foothold into the software development environment and, depending on the permissions and integrations involved, create opportunities for credential theft, lateral movement, and supply chain compromise.
“My recommendation is to start by identifying affected instances, especially those exposed to the internet, and apply the vendor's security updates immediately,” said Fredde. “But don't stop at patching. Review access logs for suspicious activity, examine exposed credentials and integration permissions, and determine whether there’s evidence of compromise before the patch was applied.”
