GitLab Patches Maximum-Severity Remote Code Execution Flaw in CI/CD Regex Compiler
CVE-2026-97229 could let an unauthenticated attacker run code on self-managed servers; GitLab.com is already patched.
GitLab has warned self-managed customers to patch a maximum-severity vulnerability in the regular expression compiler used by its CI/CD pipelines, BleepingComputer reported on October 12. The flaw is tracked as CVE-2026-97229.
The vulnerability
The bug is an integer overflow (CWE-190) in the component that parses, compiles and evaluates regular expressions in pipeline configuration files. GitLab attributes it to "insufficient regular expression validation." Under certain conditions, an unauthenticated remote attacker could use a specially crafted expression in a CI/CD configuration to execute arbitrary code on the server.
A researcher using the handle "joaxcar" reported the issue through GitLab's HackerOne bug bounty program. The report does not give a CVSS score and does not say the flaw has been exploited in the wild.
Affected and fixed versions
Self-managed Community and Enterprise editions are affected:
- 19.2 before 19.2.8
- 19.3 before 19.3.4
- 19.4 before 19.4.2
The fixes are in 19.2.8, 19.3.4 and 19.4.2 and later. GitLab says all self-managed installations should be upgraded immediately. GitLab.com already runs the patched version, and GitLab Dedicated customers do not need to act. No workaround was mentioned.
Context
BleepingComputer notes two other recent GitLab issues: a January 2026 two-factor authentication bypass (CVE-2026-0723) and an August 2026 maximum-severity flaw (CVE-2026-85706) that allowed unauthenticated reads of sensitive data such as credentials and secrets. CISA added the latter to its Known Exploited Vulnerabilities catalog a day after disclosure. CISA has flagged five GitLab vulnerabilities as exploited since November 2021, one of which was used by ransomware groups.
