GitLab patches critical CI/CD regex overflow allowing unauthenticated remote code execution
GitLab released updates for versions 19.2, 19.3 and 19.4 to fix CVE-2026-97229, an integer overflow flaw that enables arbitrary command execution via crafted pipelines.
Key points
- GitLab issued patches on October 12, 2026, for CVE-2026-97229, a CVSS 10.0 integer overflow in CI/CD regex handling.
- Researchers demonstrated a proof-of-concept that executes commands as the git user on affected Linux instances.
- The vulnerability affects self-managed Community and Enterprise Edition deployments prior to specific patch versions.
GitLab released security updates on October 12, 2026, to address CVE-2026-97229, a critical integer overflow vulnerability in its continuous integration and delivery regular-expression processing. The flaw allows an unauthenticated user to execute arbitrary code on vulnerable servers, according to the vendor’s advisory.
GitLab assigned the issue a CVSS score of 10.0, indicating critical severity. The company stated that the vulnerability affects GitLab Community Edition and Enterprise Edition versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. All deployment types are impacted unless otherwise noted by the vendor.
Technical Analysis and Exploitation
Rapid7 researchers published first-hand analysis detailing an end-to-end proof-of-concept that reliably runs arbitrary commands as GitLab’s git operating-system account. The exploit targets the official Linux amd64 gitlab/gitlab-ce:19.4.1-ce.0 image with ASLR enabled. The attack chain moves from repository inputs into Onigmo bytecode and finally to native code execution.
The vulnerability stems from how GitLab handles regular expressions in CI/CD rules. Researchers found that the scanner for repeat bounds only recognizes contiguous digits. By inserting an inline comment within the quantifier, such as `{5(?#)7805}`, attackers can hide large bounds from the scanner. The Onigmo engine ignores the comment and processes the full bound, leading to an oversized bytecode program.
When Ruby recompiles the expression for UTF-8 subjects, it bypasses GitLab’s size checks. This recompilation occurs outside the timeout mechanism, allowing the integer overflow to redirect execution. Rapid7 noted that their proof-of-concept requires pushing a malicious configuration to a public project, which conflicts with GitLab’s reported unauthenticated access rating.
Affected Versions and Mitigation Status
GitLab confirmed that its hosted service, GitLab.com, was patched before the public disclosure of the vulnerability. Dedicated customers also do not need to take action, according to the vendor. However, organizations running self-managed instances must apply the updates immediately to secure their environments.
Cyber Security News reported that researcher Jonah Burgess published a public proof-of-concept exploit for CVE-2026-97229. The exploit code demonstrates how to leverage the CI lint endpoint to trigger the vulnerability. Burgess noted that the command runs as the git account, not as an administrator, and that the test request often results in an HTTP 502 error due to worker crashes.
What should you do?
Organizations should verify their GitLab version against the affected list and apply the latest security updates immediately. Administrators should monitor for unusual CI/CD activity or worker process crashes, which may indicate exploitation attempts. Review access controls for public projects to limit the ability of external users to push malicious configurations.
What to do and how to stay safe: GitLab
- Check your GitLab instance version and compare it against the affected ranges: 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.
- Apply the security patches released on October 12, 2026, to remediate the integer overflow vulnerability in your CI/CD pipeline processing.
- Monitor server logs for unexpected worker crashes or HTTP 502 errors following CI lint requests, which may signal exploitation attempts.
- Restrict push permissions to public projects to reduce the attack surface for unauthenticated or low-privilege users attempting to inject malicious configurations.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which GitLab versions are affected by CVE-2026-97229?
GitLab CE and EE versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are affected by the vulnerability.
Is there a public exploit for this vulnerability?
Yes, researcher Jonah Burgess published a proof-of-concept exploit that demonstrates remote code execution via the CI lint endpoint.
Does GitLab.com need to be patched?
No, GitLab stated that GitLab.com was patched before the disclosure, and Dedicated customers do not need to take action.
