Key points
- CVE-2026-97229 carries a CVSS score of 10.0 and affects unauthenticated users.
- Patches are available for GitLab CE and EE versions 19.2, 19.3, and 19.4.
- Self-managed administrators must upgrade immediately; GitLab.com users are safe.
GitLab has released urgent security updates to address a critical vulnerability in its CI/CD Regular Expression Compiler. The flaw, tracked as CVE-2026-97229, allows remote attackers to execute arbitrary code on targeted instances without authentication. According to Cyber Security News, the issue carries a maximum CVSS score of 10.0 and affects both Community and Enterprise editions.
The vulnerability stems from an integer overflow weakness in how the compiler processes regular expressions within pipeline configuration files. An unauthenticated user can exploit this by submitting a specially crafted expression. GitLab stated that insufficient validation enabled this server-side code execution, which threatens the integrity and availability of the host system.
What we know
GitLab fixed the security issue in versions 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2. The company urged all self-managed installations to upgrade immediately. GitLab.com is already running the patched version, and GitLab Dedicated customers do not need to take action, according to the vendor’s advisory.
Security researcher joaxcar discovered the flaw and reported it via GitLab’s HackerOne bug bounty program. This is the latest in a series of recent vulnerabilities. In January, GitLab patched a high-severity two-factor authentication bypass, and last month it addressed another maximum-severity flaw allowing data theft, as reported by BleepingComputer.
The U.S. Cybersecurity and Infrastructure Security Agency added the previous data theft flaw to its exploited vulnerabilities catalog. CISA has flagged five GitLab flaws abused in attacks since November 2021. While this new code execution flaw is severe, the release notice does not state that attackers have exploited it in real-world attacks yet.
Defender's checklist
- Verify if your GitLab instance is self-managed or hosted on GitLab.com.
- Check your current version against the affected ranges: 19.2, 19.3, and 19.4.
- Review CI/CD pipeline configurations for any unusual regular expression patterns.
- Monitor server logs for signs of unauthorized code execution attempts.
What to do and how to stay safe: GitLab
- Identify all self-managed GitLab servers in your environment and check their version numbers.
- Schedule an immediate upgrade to the patched versions: 19.2.8, 19.3.4, or 19.4.2.
- Monitor network traffic for anomalous outbound connections from CI/CD runners.
- Once the vendor provides an update, test it in a staging environment before production deployment.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this vulnerability affect GitLab.com users?
No, GitLab.com is already running the patched version, and GitLab Dedicated customers do not need to take action.
What is the severity of CVE-2026-97229?
The flaw carries a maximum CVSS score of 10.0 and allows unauthenticated remote code execution.
Which GitLab versions are affected?
Versions 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2 are affected.
