CybersecurityVulnerability Management

GitLab Patches Code Execution Flaw in CI/CD Compiler

Analyst 207||Source: BleepingComputer
Modern office workstation with laptop and cluttered desk in natural daylight.

CVE-2026-97229 — a maximum-severity code-execution flaw in GitLab’s CI/CD Regular Expression Compiler — can let remote attackers run arbitrary code on targeted instances, the company warned today.

CVE-2026-97229: integer overflow in the CI/CD Regular Expression Compiler

The vulnerability, tracked as CVE-2026-97229, stems from an integer overflow weakness in GitLab’s CI/CD Regular Expression Compiler, the component that parses, compiles, and evaluates regular expressions in projects’ pipeline configuration files. The flaw was discovered by a security researcher using the handle “joaxcar” and reported through GitLab’s HackerOne bug bounty program.

In a Monday advisory, GitLab described the impact bluntly: “GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.” The company characterized the issue as allowing unauthenticated remote code execution when the conditions for exploitation are met.

Fixed releases and who needs to upgrade

GitLab implemented a patch and released fixed builds for both Community Edition (CE) and Enterprise Edition (EE). The affected ranges and their patched endpoints are:

  • 19.2 — versions before 19.2.8
  • 19.3 — versions before 19.3.4
  • 19.4 — versions before 19.4.2

GitLab urged administrators to apply these updates immediately, writing: “These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately.” The company said GitLab.com is already running the patched version and added that GitLab Dedicated customers do not need to take action.

Scope of the risk: unauthenticated, remote, and maximum-severity

Two features of the advisory heighten the urgency. First, the vulnerability is described as maximum-severity and capable of arbitrary code execution. Second, exploitation could occur without authentication via a specially crafted regular expression placed in a CI/CD configuration file — a component developers frequently populate with pipeline rules and pattern matches. That combination makes the flaw attractive to remote attackers seeking initial access to self-hosted instances.

CISA flags and recent GitLab fixes

This advisory is the latest in a run of fixes GitLab announced in recent months. The company “last month” addressed another issue tied to vulnerable servers, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has highlighted past GitLab weaknesses: “CISA has flagged five GitLab flaws abused in attacks since November 2021, including one that was exploited by ransomware gangs,” the source notes. Those prior flags underline that GitLab-related flaws have been observed in real-world exploitation campaigns.

What this means for technologists, enterprises, and GitLab Dedicated customers

  • Technologists and security teams: Teams running self-managed GitLab instances must prioritize applying the fixed 19.2.8, 19.3.4, or 19.4.2 builds — or later — to eliminate the CVE-2026-97229 attack vector. The advisory frames this as an urgent upgrade for self-managed installations.
  • Enterprises and procurement leaders: GitLab’s platform is widely used: the company says it has “over 30 million registered users and more than 50% of Fortune 100 companies” on its DevSecOps platform, naming Nvidia, T‑Mobile, Lockheed Martin, Airbus, and Goldman Sachs as examples. Large organizations that run self-hosted instances will need to confirm patching across any internal, departmental, or vendor-hosted deployments.
  • GitLab Dedicated customers: According to GitLab’s advisory, GitLab Dedicated customers do not need to take action; GitLab.com is already running the patched version.

Reported through HackerOne by the researcher known as “joaxcar,” CVE-2026-97229 joins a sequence of GitLab fixes that CISA has said were abused in attacks since November 2021. With the company’s public instances already patched and the fix available for self-managed releases, the immediate question is whether organizations with internal deployments will treat the advisory with the urgency the advisory itself insists upon — and whether defenders will audit CI/CD configurations for other patterns that could expose pipeline compilers or parsers to crafted inputs.

Original story

Ci/CdCode ExecutionDevsecopsEmerging ThreatsSoftware DevelopmentSupply ChainVulnerability ManagementGitlabRegular Expression CompilerCVE-2026-97229
Related Intelligence

Continue Reading

Industrial control room with programmable logic controllers, robotic arm, and network infrastructure setup.

AI Models Expose Vulnerability of Critical Infrastructure to Cyberattacks

AI-powered attacks can now outmaneuver traditional defenses, putting critical infrastructure at risk of devastating breaches if essential cybersecurity practices aren't in place. Advanced AI models have been shown to execute complex attacks with alarming speed and precision, outpacing organizations that haven't implemented robust OT cybersecurity measures.

Analyst 207
Cybersecurity expert stands in front of large screen in modern Singapore business district.

Criminal IP Unveils AITEM to Revolutionize Attack Surface Management

Discovering threats is only half the battle - responding to them effectively is where the real challenge lies. AITEM, the latest AI-powered attack surface management solution from Criminal IP, is here to bridge that gap and revolutionize the way organizations defend themselves.

Analyst 207
Rows of equipment racks and devices in a network operations center or server room.

Agents Expose Blind Spots in AI Security Controls

The surprising truth is that about 1,000 AI-powered agents are hiding in plain sight, operating outside the view of your identity infrastructure - and it's not because they're trying to evade detection. They're simply embedded in the software you already use, creating a blind spot in your security controls.

Analyst 207
Laptop screen with suspicious URL in cluttered workspace near window with natural light.

Typosquatters Exploit Chromium Browser Flaw with Two Characters

Researchers have discovered a clever trick to bypass Chromium browser security measures using just two obscure characters, allowing them to create convincing lookalike URLs that can easily fool users. By exploiting this flaw, cybercriminals can register fake domains that are virtually indistinguishable from legitimate ones.

Analyst 207