GitLab warned its users of a critical security vulnerability with the highest severity rating in the CI/CD Regular Expression Compiler component, which could allow a remote, unauthenticated attacker to execute arbitrary code on a targeted GitLab server. The vulnerability is tracked as CVE-2026-97229 and was discovered by a security researcher using the alias joaxcar, who reported it through HackerOne’s bug bounty program.
How Does the Vulnerability Work?
The issue is related to an integer overflow weakness inside the regular expression compiler, the component that parses, compiles, and evaluates regular expressions in CI/CD pipeline configuration files. According to GitLab’s advisory, under certain circumstances, insufficient validation of regular expressions can be exploited through a specially crafted expression within CI/CD configuration, allowing an unauthenticated user to execute code on a GitLab server.
Affected Versions and Updates
GitLab fixed the issue in its Community Edition and Enterprise Edition in the following releases:
- Version 19.2.8 or later, instead of versions earlier than 19.2.8.
- Version 19.3.4 or later, instead of versions earlier than 19.3.4.
- Version 19.4.2 or later, instead of versions earlier than 19.4.2.
The company recommends that all users of self-hosted GitLab installations upgrade immediately to one of these versions, which also include bug and security vulnerability fixes. GitLab.com is already running the patched version, and GitLab Dedicated customers do not need to take action, according to the company.
Why Does This Matter?
The vulnerability is significant because exploiting it does not require authentication, while a successful attack could result in code execution on a server hosting projects and CI/CD pipelines. Therefore, the practical scope of impact is concentrated in environments that manage GitLab themselves, not among GitLab.com or GitLab Dedicated users, according to the available information.
This remediation follows a series of vulnerabilities that GitLab has fixed in recent months. In January, the company addressed a high-severity vulnerability for bypassing two-factor authentication, tracked as CVE-2026-0723, while last month it fixed another vulnerability with the highest severity rating, CVE-2026-85706, which allowed unauthenticated attackers to read sensitive data, including credentials and secrets, from affected servers.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85706 to its Known Exploited Vulnerabilities Catalog one day after it was fixed and asked federal agencies to secure their systems within three days. Published information also indicated that CISA had observed the exploitation of five GitLab vulnerabilities in attacks since November 2021, including a vulnerability used by groups conducting ransomware attacks.
The source does not establish that the new CVE-2026-97229 vulnerability has been actively exploited so far. Therefore, the confirmed action remains to urgently update self-hosted versions and review the relevant CI/CD configurations.