GitLab Urges Immediate Patching of Critical CI/CD Vulnerability Allowing Remote Code Execution
GitLab is urging users to immediately patch a maximum-severity vulnerability in its CI/CD regular expression compiler that could allow an unauthenticated remote attacker to execute arbitrary code on a targeted GitLab instance.
Critical GitLab flaw tracked as CVE-2026-97229
Tracked as CVE-2026-97229, the critical security flaw was discovered by security researcher joashkar and reported through GitLab’s HackerOne bug bounty program.
CVE-2026-97229 is an integer overflow weakness in GitLab’s CI/CD regular expression compiler, which parses, compiles, and evaluates regular expressions in project pipeline configuration files.
“GitLab has fixed an issue where insufficient regular expression validation could, under certain conditions, allow unauthenticated users to execute arbitrary code on GitLab servers via specially crafted regular expressions in CI/CD configurations,” the company explained in Monday’s advisory.
Affected GitLab versions and available fixes
GitLab fixed the vulnerability in Community Edition (CE) and Enterprise Edition (EE) versions 19.2.8, 19.3.4, and 19.4.2. Specifically, affected versions include:
- GitLab 19.2 versions before 19.2.8
- GitLab 19.3 versions before 19.3.4
- GitLab 19.4 versions before 19.4.2
The company urged administrators to patch their self-managed GitLab servers immediately.
“These versions contain important bugs and security fixes, and we strongly recommend that all self-managed GitLab installations upgrade to one of these versions immediately,” GitLab warned. “GitLab.com is already running a patched version. GitLab Dedicated customers do not need to take any action.”
GitLab has faced several recent security issues
CVE-2026-97229 is the latest in a series of vulnerabilities GitLab has addressed in recent months. In January, GitLab patched a high-severity two-factor authentication bypass tracked as CVE-2026-0723. The flaw allowed an attacker who knew a target’s account ID to bypass two-factor authentication on Community Edition and Enterprise Edition servers.
Last month, GitLab also addressed a maximum-severity vulnerability in GitLab CE/EE tracked as CVE-2026-85706. The flaw allowed an unauthenticated attacker to read sensitive data, including credentials and other secret information, from vulnerable servers.
The next day, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85706 to its Known Exploited Vulnerabilities Catalog and ordered federal agencies to secure their systems within three days.
CISA has flagged five GitLab vulnerabilities as having been exploited in attacks since November 2021, including attacks carried out by ransomware gangs.
GitLab says its DevSecOps platform is used by more than 30 million registered users and more than 50% of Fortune 100 companies, including Nvidia, T-Mobile, Lockheed Martin, Airbus, and Goldman Sachs.
Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a 2-hour digital summit about what will change with AI speed attacks, what defenders should stop doing, and how to verify, decide, fix, and revalidate at machine speed.
Source: www.bleepingcomputer.com