GitLab Patches Critical Remote Code Execution Flaw in CI/CD Regex Compiler

GitLab released security updates on October 12, 2026, to address a maximum-severity vulnerability that permits unauthenticated remote code execution on affected servers. The flaw, tracked as CVE-2026-97229, carries a CVSS score of 10.0 and impacts both Community Edition and Enterprise Edition installations.

The vulnerability stems from an integer overflow within the CI/CD Regular Expression Compiler, which processes pipeline configuration files. According to GitLab, insufficient validation allows attackers to execute arbitrary code by submitting a specially crafted regular expression. This server-side execution threat compromises confidentiality, integrity, and availability with low attack complexity.

Context and Background

Security researcher joaxcar identified the flaw and reported it via GitLab's HackerOne bug bounty program. The company stated that exploitation requires certain conditions, though the advisory did not specify the exact attack sequence or prerequisites. The CVSS vector indicates that no user interaction or privileges are required to trigger the vulnerability.

This issue follows a series of recent GitLab vulnerabilities. In January, the vendor patched a high-severity two-factor authentication bypass, CVE-2026-0723. Last month, GitLab addressed another maximum-severity flaw, CVE-2026-85706, which allowed unauthenticated reading of sensitive data. One day later, CISA added that flaw to its catalog and ordered federal agencies to secure systems within three days.

Who Is Affected

The vulnerability affects GitLab Community Edition and Enterprise Edition versions 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2. Self-managed installations must upgrade immediately to the corresponding patched releases. GitLab.com is already running the fixed version, and GitLab Dedicated customers do not need to take action.

Unlike previous CI/CD regex vulnerabilities patched in September, which required authentication, this new flaw allows exploitation without an account. The advisory does not confirm whether these issues share the same underlying cause. No evidence suggests that attackers have exploited CVE-2026-97229 in the wild.

What should you do?

Administrators should verify their current GitLab version against the affected release list. If running a vulnerable version, apply the latest security update immediately. Monitor system logs for unusual activity related to CI/CD pipeline executions. Review access controls for configuration files to limit potential exposure until patches are applied.

What to do and how to stay safe: GitLab

• Check your GitLab instance version to determine if it falls within the affected 19.2, 19.3, or 19.4 ranges.
• Apply the latest security patch from GitLab as soon as possible to mitigate the risk of remote code execution.
• Monitor server logs and CI/CD pipeline activities for signs of unauthorized code execution or unusual regular expression usage.
• Ensure that only trusted users have permissions to modify CI/CD configuration files on self-managed installations.

Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-97229?

It is a critical vulnerability in GitLab's CI/CD Regular Expression Compiler that allows unauthenticated remote code execution via crafted expressions.

Which GitLab versions are affected?

GitLab CE and EE versions 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2 are vulnerable.

Has this vulnerability been exploited in the wild?

The release notice does not state that attackers have exploited this specific vulnerability in real-world attacks.