GitLab warns of maximum severity code execution vulnerability

Critical flaw in CI/CD regex compiler

GitLab warned users on Monday to immediately patch a maximum severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances. Tracked as CVE-2026-97229, the critical flaw was discovered by a security researcher using the handle joaxcar and reported through GitLab's HackerOne bug bounty program.

According to GitLab's advisory, the issue stems from an integer overflow weakness in the component that parses, compiles and evaluates regular expressions in projects' pipeline configuration files. Under certain conditions, an unauthenticated user could execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

Patches and affected versions

GitLab fixed the issue in Community Edition (CE) and Enterprise Edition (EE) versions 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2. The company said these versions contain important bug and security fixes and strongly recommended that all self managed GitLab installations be upgraded to one of these versions immediately.

GitLab.com is already running the patched version, and GitLab Dedicated customers do not need to take action.

Recent GitLab security issues

CVE-2026-97229 is the latest in a string of vulnerabilities GitLab has addressed in recent months. In January, the company patched a high severity two factor authentication bypass (CVE-2026-0723) that lets attackers who know the target's account ID circumvent two factor authentication on community and enterprise edition servers.

Last month, GitLab addressed another maximum severity vulnerability (CVE-2026-85706) in CE/EE that allows unauthenticated attackers to read sensitive data, such as credentials and other secrets, from vulnerable servers. One day later, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85706 to its catalog of flaws exploited in the wild and ordered federal agencies to secure their systems within three days.

CISA has flagged five GitLab flaws abused in attacks since November 2021, including one that was exploited by ransomware gangs. GitLab says over 30 million registered users and more than 50% of Fortune 100 companies use its DevSecOps platform, including Nvidia, T Mobile, Lockheed Martin, Airbus and Goldman Sachs.

Sources: Lobsters