-
After the discovery of CVE-2026-97229, a critical RCE vulnerability, in its CI/CD Regular Expression Compiler, GitLab has released a fix.
-
The flaw can allow attackers to run arbitrary code on affected self-managed GitLab CE and EE servers.
-
The company expects administrators to immediately upgrade to other safe versions of GitLab to contain the flaw.
GitLab has recommended its users to rectify a maximum-severity remote code execution vulnerability in its CI/CD Regular Expression Compiler. The company stated that criminals can utilize the threat even without an account.
The vulnerability, CVE-2026-97229, carries a CVSS rating of 10. GitLab fixed it in new Community Edition and Enterprise Edition releases on October 12.
How the Flaw Works
The occurrence lies within the CI/CD Regular Expression Compiler. This is a component that processes, composes, and interprets regular expressions in pipeline setting files.
GitLab discovered a case of integer overflow in that compiler. Integer overflow occurs when a program obtains an integer larger than the memory space available to it. Consequently, this may generate several issues and give the opportunity to unauthorized individuals to gain access.
An attacker can submit a well-formed expression via a CI/CD configuration. Thus, the system can execute the expressions if favorable conditions exist, allowing the actor to run any code on the server.
Remote code execution (RCE) stands as one of the most dangerous types of software errors. It may allow a hacker to compromise the server, its files, and the systems connected to it. GitLab classified this incident as critical, as it has no need for user interaction or a valid login.
Who Needs to Patch
The vulnerability impacts the self-managed versions of GitLab Community Edition and GitLab Enterprise Edition. The flawed versions include every release of GitLab from 19.2 before 19.2.8, from 19.3 before 19.3.5 and from 19.4 before 19.4.2.
The company released its versions 19.2.8, 19.3.5 and 19.4.2 to fix this vulnerability. Initially, the company included version 19.3.4 in the list of fixes. However, it later replaced version 19.3.4 with 19.3.5 due to an encountered bug when using merge request pages after the introduction of the Ona integration.
Administrators running affected versions should upgrade immediately. GitLab says the new releases also contain other security and bug fixes.
Users of GitLab.com need not worry since the hosted service is using the corrected version. GitLab Dedicated customers also do not need to take any measures since the company manages these environments.
Why the Risk is High
GitLab is a widely recognized platform in the DevSecOps industry that allows teams to handle source codes, perform automated tests, and roll out applications through CI/CD. There are more than 30 million users who are registered on this platform and many Fortune 100 organizations are using it.
Its reach gives the flaw a lot of weight for many organizations. Some companies, such as Nvidia, T-Mobile, Lockheed Martin, Airbus, and Goldman Sachs utilize GitLab. This means a compromised GitLab server could expose several threats, including source code, deployment secrets, and access to software supply chain.
Moreover, a CVSS rating of 10 reflects the severity of this problem. The score notes that this is an over-the-network, low-complexity attack requiring no privileges, but affecting confidentiality, integrity, and availability.
Security researcher joaxcar discovered the flaw and reported it through the HackerOne bug bounty program of GitLab. Also, GitLab credited the researcher in its advisory.
Recent GitLab Security Issues
This is not the only serious GitLab vulnerability patched recently. In January, the company fixed a high-severity two-factor authentication bypass tracked as CVE-2026-0723. An attacker who knew a target’s account ID could bypass 2FA on Community and Enterprise Edition servers.
Last month, GitLab handled another high-severity issue, CVE-2026-85706. The issue works as a path traversal vulnerability that allows any unauthenticated attacker to read sensitive data, including credentials and secrets from compromised servers.
The very next day after resolving this issue, U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-85706 to its list of Known Exploited Vulnerabilities Catalog. Further, the regulator instructed all federal agencies to secure affected systems within three days.
CISA has flagged five GitLab flaws abused in attacks since November 2021. Ransomware gangs exploited at least one of those flaws. Other enterprise software vulnerabilities have also come under active attack, including critical Citrix NetScaler flaws exploited by hackers, as detailed in hackers exploited critical Citrix NetScaler flaws in active cyberattacks.
The latest patch release also addressed other issues. They include a high-severity cross-site scripting flaw in syntax highlighting plus an authorization issue with downstream pipeline creation. Also, it handles a permissive regular expression issue with repository file access.
What Administrators Should Do
First, administrators must determine which version of GitLab they use and update any self-managed installations to 19.2.8, 19.3.5, or 19.4.2. Teams are also required to find any unusual regex patterns in CI/CD pipeline settings. They should limit access to GitLab servers, rotate exposed credentials, and monitor logs for suspicious activity.
GitLab says the patch includes database migrations. Single-node installations may experience downtime during the upgrade, while properly configured multi-node deployments can use zero-downtime upgrade procedures.
The company advises all customers to stay on the latest supported patch release. It says this practice helps reduce exposure to known security weaknesses.
