The US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that attackers have begun exploiting a critical, maximum-severity security vulnerability in the popular development platform GitLab, just a few weeks after the release of its security updates.
Details of the Critical Vulnerability in the Regular Expression Processor
The vulnerability carries the identifier CVE-2026-97229 and was discovered by a security researcher known by the pseudonym "joaxcar". The issue lies in the CI/CD Regular Expression Compiler component, which handles the parsing, compilation, and evaluation of regular expressions within pipeline configuration files. The vulnerability arises from an integer overflow flaw accompanied by a lack of sufficient expression validation, allowing unauthorized attackers to execute arbitrary code remotely via the platform's servers.
Release Actions and Protection Directives
GitLab promptly issued urgent patches addressing this security vulnerability in both the Community Edition (CE) and Enterprise Edition (EE) starting from versions 19.4.2, 19.3.5, and 19.2.8, urging system administrators and server managers to apply the updates without delay. The company also launched threat detection tools to help customers who manage their own servers.
Official Actions and the Known Exploited Vulnerabilities Catalog
CISA officially added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog and issued a binding operational directive numbered (BOD 26-04) requiring federal agencies to secure and update their servers. Although this directive targets federal entities exclusively, the agency urged all private sector security teams to give top priority to patching this vulnerability.
Context of Recurring Security Attacks on the Platform
This vulnerability comes within a series of security issues faced by the GitLab platform, as CISA has detected six security vulnerabilities in the platform that were exploited in the wild since November 2021. It is worth noting that GitLab's DevSecOps platform is used by more than 50% of Fortune 100 companies and includes over 70 million registered users worldwide.