Deeper in the article: https://docs.gitlab.com/releases/patches/patch-release-gitla...

GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression. (...)

CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Here, CVSS 10.0 means arbitrary remote code execution.