Thought Leadership
Via a crafted regular expression in a CI/CD configuration, attackers can execute code without authentication. GitLab advises an immediate update.
GitLab has patched a vulnerability with the highest severity rating in GitLab Community Edition (CE) and Enterprise Edition (EE). The vulnerability, tracked as CVE-2026-97229, resides in the regular expression compiler of the CI/CD feature. This component processes, compiles, and evaluates regular expressions in projects’ pipeline configuration files. The cause is an integer overflow. The flaw was reported by a security researcher named “joaxcar” via GitLab’s bug bounty program on HackerOne.
“GitLab has resolved an issue that could have allowed an unauthenticated user, under certain conditions, to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration due to insufficient validation of regular expressions.”
GitLab
Updates for Three Version Branches
Affected are versions 19.2 prior to 19.2.8, 19.3 prior to 19.3.4, and 19.4 prior to 19.4.2. GitLab recommends updating all self-managed installations immediately to one of the patched versions. GitLab.com is already running the patched version; GitLab Dedicated customers do not need to take any action. GitLab mentions no indications of the vulnerability being actively exploited.
Additional Critical Vulnerabilities This Year
In September, GitLab had already fixed another vulnerability with the highest severity level (CVE-2026-85706). It allowed unauthenticated attackers to read sensitive data, such as credentials, from vulnerable servers. The US cybersecurity agency CISA added it to its catalog of actively exploited vulnerabilities one day later and mandated federal agencies to secure their systems within three days. In January, GitLab had resolved a two-factor authentication bypass vulnerability (CVE-2026-0723). In total, CISA lists five GitLab vulnerabilities that have been exploited in attacks since November 2021.
According to its own figures, GitLab has more than 30 million registered users, and more than half of the Fortune 100 companies use the platform.
(Editorial Team)
