"GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation," the company said in a Monday advisory.
CVE-2026-97229: a maximum-severity integer overflow tied to CI/CD regular expressions
GitLab disclosed a maximum-severity vulnerability tracked as CVE-2026-97229 and assigned a CVSS score of 10.0. The company described the defect as an integer overflow rooted in insufficient validation of regular expressions used in CI/CD configurations. Under certain conditions, the flaw could allow an unauthenticated user to execute arbitrary code on the GitLab server by supplying a specially crafted regular expression.
Affected GitLab versions and the patches you can install
The vulnerability affects multiple recent Community Edition (CE) and Enterprise Edition (EE) releases. Specifically, all versions from 19.2 before 19.2.8; all versions from 19.3 before 19.3.5; and all versions from 19.4 before 19.4.2 are impacted. GitLab published fixes in versions 19.4.2, 19.3.5, and 19.2.8.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleThree related high-severity fixes also addressed
- CVE-2026-92883 (CVSS 8.7) — a cross-site scripting vulnerability that could allow an authenticated user to execute arbitrary JavaScript in the context of other users' browser sessions via a specially crafted repository.
- CVE-2026-16301 (CVSS 8.5) — an improper authorization vulnerability in the downstream pipeline creation service that could permit an authenticated user with Developer role to execute CI/CD pipelines on protected branches.
- CVE-2026-14814 (CVSS 8.2) — a permissive regular expression vulnerability that could allow a user to poison cached responses for raw repository files, causing targeted users’ CI/CD pipelines to execute specially crafted content and potentially exposing protected environment variables.
Recent context inside GitLab's security briefings
The advisory comes weeks after GitLab addressed another critical issue in its AI Gateway, tracked as CVE-2026-90970 with a CVSS score of 9.9. That flaw could have allowed an authenticated user with Duo Agent Platform access to break out of a prompt template sandbox via a specially crafted flow configuration and achieve arbitrary command execution on the AI Gateway. Separately, the company noted that last month a different maximum-severity flaw in GitLab CE and EE, CVE-2026-85706 (CVSS 10.0), saw in-the-wild probes within hours of public disclosure.
What this means for CI/CD administrators, security teams, and platform operators
- CI/CD administrators: The immediate, concrete action is to update affected GitLab installations to the patched releases — 19.4.2, 19.3.5, or 19.2.8 — because the disclosed defect can be triggered by malformed regular expressions supplied in CI/CD configurations.
- Security teams: Given the history of rapid in-the-wild probes following recent disclosures (notably CVE-2026-85706), teams should prioritize patching and monitor telemetry for anomalous attempts to submit or process unusual regular expressions in pipeline definitions.
- Platform operators and DevOps: The set of related fixes — including an improper authorization issue that affects Developer-role users on protected branches (CVE-2026-16301) and a cached-response poisoning risk (CVE-2026-14814) — underscores that pipeline definitions and repository content remain a high-impact attack surface that warrants rapid remediation and focused operational attention.
GitLab’s advisory provides a clear immediate step: install the patched releases named above. The broader pattern in recent advisories — critical fixes in AI Gateway and a separate max-severity flaw that saw probes within hours — raises a pointed operational question for every team running self-hosted GitLab: will attackers move quickly to probe CVE-2026-97229 now that the issue is public and high-severity mitigations exist? The answer will be revealed in the telemetry and logs of those who apply the patches — and of those who do not.
