GitLab fixes 10 out of 10 flaw letting attackers run code

GitLab has rushed out fixes for a bug that could let an attacker run their own commands on a self-hosted GitLab server, which is what security people call remote code execution. The flaw, CVE-2026-97229, scores 10.0 out of 10 on the industry's CVSS severity scale, the highest rating there is. It sits in the part of GitLab that reads the automated build instructions people keep in their projects, and it is triggered by a booby-trapped text pattern hidden in those instructions.