GitLab is urging users of self-managed instances to patch a critical vulnerability (CVE-2026-97229) in its CI/CD Regular Expression Compiler that could allow remote attackers to execute arbitrary code on GitLab servers.
About CVE-2026-97229
CVE-2026-97229 is an integer overflow vulnerability in GitLab’s CI/CD Regular Expression Compiler, and it affects both GitLab Community Edition (CE) and Enterprise Edition (EE).
GitLab has assigned the vulnerability a CVSS score of 10.0, the highest possible. According to the CVSS vector, the flaw can be exploited remotely, with low complexity, and without privileges or user interaction.
“GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation,” reads the advisory.
GitLab fixed the flaw in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5 and 19.2.8, released on October 12, 2026. The vulnerability affects all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.
“These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately,” the company warned.
“GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action,” it added.
The vulnerability was reported by a researcher going by the handle joaxcar through GitLab’s HackerOne bug bounty program.
The same researcher also reported CVE-2026-7767, a medium-severity open redirect flaw in GitLab’s Kubernetes proxy that could lead to sensitive authentication tokens being sent to an unintended server.
CVE-2026-97229 is the latest of several vulnerabilities GitLab has fixed in recent months. In August, the company released patches for CVE-2026-19478, a critical code injection flaw that could be exploited without authentication to modify or delete public projects and user data.
UPDATE (October 13, 2026, 09:45 a.m. ET):
Rapid7 researchers have reproduced arbitrary code execution on an unpatched official GitLab CE image (version 19.4.1), while the same input did not work against the patched 19.4.2 image.
The vendor’s CVSS score indicates the exploit requires no authentication, but the researchers found that “attacker must first be able to commit a malicious CI/CD configuration file .gitlab-ci.yml, and a repository path containing UTF-8 characters to a branch in a public project.”
According to Rapid7, an ordinary account can meet this requirement on self-managed instances that allow users to create public projects.
“As of this writing, there is no confirmed in-the-wild exploitation of CVE-2026-97229,” the researchers noted.
Rapid7 recommends that organizations upgrade affected self-managed instances urgently, outside their normal patch cycles.
