GitLab Patches Max-Severity Code Execution Flaw in CI/CD Regex Compiler

GitLab has urged its users to apply an update immediately to close a maximum-severity vulnerability. The flaw, located in the CI/CD Regular Expression Compiler, could allow remote attackers to execute arbitrary code on vulnerable servers.

What went wrong

The vulnerability is tracked as CVE-2026-97229. It was discovered by a security researcher using the handle joaxcar and reported through GitLab's HackerOne bug bounty program.

The issue stems from an integer overflow in the CI/CD Regular Expression Compiler — the component that parses, compiles, and evaluates regular expressions in projects' pipeline configuration files. According to the company, insufficient validation of regular expressions meant that, under certain conditions, an unauthenticated user could execute arbitrary code on the GitLab server by submitting a specially crafted expression in a CI/CD configuration.

Affected versions

GitLab fixed the flaw in both Community Edition (CE) and Enterprise Edition (EE): in the 19.2 branch before 19.2.8, in 19.3 before 19.3.4, and in 19.4 before 19.4.2. The company strongly recommends that all self-managed installations upgrade to one of these versions immediately. GitLab.com is already running the patched version, and GitLab Dedicated customers need take no action.

Not the first in recent months

CVE-2026-97229 is the latest in a string of vulnerabilities GitLab has addressed recently. In January, it patched a high-severity two-factor authentication bypass that worked if an attacker knew the target's account ID (CVE-2026-0723). Last month it fixed another maximum-severity flaw (CVE-2026-85706) that let unauthenticated attackers read sensitive data, including credentials and other secrets, from vulnerable servers.

Just one day after its disclosure, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85706 to its catalog of actively exploited flaws and ordered federal agencies to remediate within three days. Since November 2021, CISA has flagged five GitLab flaws abused in attacks, including one exploited by ransomware gangs.

GitLab says its DevSecOps platform is used by more than 30 million registered users and over half of the Fortune 100 companies, among them Nvidia, T-Mobile, Lockheed Martin, Airbus, and Goldman Sachs.

Source: Bleeping Computer