GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances.
Tracked as CVE-2026-97229, this critical security flaw was discovered by a security researcher using the ‘joaxcar’ handle and reported via GitLab’s HackerOne bug bounty program.
CVE-2026-97229 stems from an integer overflow weakness in GitLab’s CI/CD Regular Expression Compiler, which parses, compiles, and evaluates regular expressions in projects’ pipeline configuration files.
“GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation,” the company explained in a Monday advisory.
GitLab fixed the security issue in GitLab Community Edition (CE) and Enterprise Edition (EE) versions from 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2, and urged users to patch their servers immediately.
“These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately,” it warned. “GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.”
CVE-2026-97229 is the latest in a string of vulnerabilities that GitLab has addressed in recent months. In January, GitLab patched a high-severity two-factor authentication bypass (CVE-2026-0723 that lets attackers who know the target’s account ID circumvent two-factor authentication on community and enterprise edition servers.
Last month, it addressed another maximum-severity vulnerability (CVE-2026-85706) in GitLab CE/EE that allows unauthenticated attackers to read sensitive data, such as credentials and other secrets, from vulnerable servers.
One day later, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85706 to its catalog of flaws exploited in the wild and ordered federal agencies to secure their systems within three days.
CISA has flagged five GitLab flaws abused in attacks since November 2021, including one that was exploited by ransomware gangs.
GitLab says that over 30 million registered users and more than 50% of Fortune 100 companies use its DevSecOps platform, including Nvidia, T-Mobile, Lockheed Martin, Airbus, and Goldman Sachs.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Cisco warns of critical flaws allowing Nexus switch takeover
New Dell System Update flaw lets hackers gain root privileges
GitLab warns of critical RCE vulnerability in AI Gateway service
Check Point warns of hackers exploiting Security Gateway VPN RCE flaw
Hackers start exploiting critical WordPress flaw for code execution
Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks
Cyber exec arrested in case allegedly tied to ShinyHunters hackers
Microsoft: Outdated Windows devices will stop receiving security updates
Move from visibility to action with AITEM, Criminal IP’s next evolution of ASM
Learn how to evaluate RMM security with eight practical tests. Find gaps before scaling endpoint management across customer environments.
Free Identity Governance for up to 150 Users: Try Our Community Edition
New OAuth risk analyst agent: Turn 45 minutes of manual review into 15 seconds.
AWS saw a valid key and let the agent clear a production bucket. See how Token Security ties each agent to its owner and limits it to read-only access.
Is your backup really out of reach? See what the latest attacks reveal.
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
