Tuesday 13 October 2026
Night Edition
ZOTPAPER

News without the noise

ZOTPAPER
Security

GitLab urges immediate patching of maximum-severity code execution flaw

CVE-2026-97229 lets unauthenticated attackers run arbitrary code via crafted regex in CI/CD configuration

By LineZotpaper
Published
Read Time2 min
GitLab has warned administrators of self-managed installations to patch immediately after disclosing a maximum-severity vulnerability in its CI/CD Regular Expression Compiler that could allow remote attackers to run arbitrary code on affected servers. The flaw, tracked as CVE-2026-97229, is fixed in the latest releases of GitLab Community and Enterprise Edition.

GitLab disclosed the critical vulnerability in a Monday advisory, saying it stems from an integer overflow weakness in the CI/CD Regular Expression Compiler, the component that parses, compiles and evaluates regular expressions in projects' pipeline configuration files.

"GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation," the company said.

The vulnerability was discovered by a security researcher using the handle "joaxcar" and reported through GitLab's HackerOne bug bounty program.

GitLab fixed the issue in Community Edition (CE) and Enterprise Edition (EE) versions 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2. "These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately," the company warned. GitLab.com is already running the patched version, and GitLab Dedicated customers do not need to take action.

The disclosure continues a difficult period for the platform. In January, GitLab patched a high-severity two-factor authentication bypass, and last month it addressed another maximum-severity flaw, CVE-2026-85706, a path traversal vulnerability that let unauthenticated attackers read credentials and other secrets from vulnerable servers. One day after that fix, the US Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog.

§

Analysis

Why This Matters

  • Self-managed GitLab servers hold source code, credentials and CI/CD pipeline secrets; unauthenticated remote code execution puts all of that at risk.
  • GitLab has now disclosed multiple serious flaws this year, including a path traversal bug that CISA added to its known exploited vulnerabilities catalog within a day.
  • Administrators of affected CE and EE versions have no mitigation short of upgrading to the fixed releases, which GitLab has urged them to do immediately.

Background

GitLab is a widely used DevOps platform for hosting source code and running automated CI/CD pipelines. Many organisations run self-managed Community Edition or Enterprise Edition instances rather than the cloud-hosted GitLab.com service. The new flaw sits in the component that processes regular expressions in pipeline configuration files. GitLab's recent security record includes a two-factor authentication bypass fixed in January and a maximum-severity path traversal vulnerability addressed last month, which CISA has since added to its catalog of known exploited vulnerabilities. That earlier flaw allowed unauthenticated attackers to read sensitive data such as credentials from vulnerable servers.

Key Perspectives

GitLab: The company rates the bug at maximum severity, says it is fixed in versions 19.2.8, 19.3.4 and 19.4.2, and strongly recommends all self-managed installations upgrade immediately. It notes that GitLab.com is already patched and that Dedicated customers need take no action.

Security researchers: The flaw was found by a researcher using the handle "joaxcar" and reported through GitLab's HackerOne bug bounty program, reflecting continued external scrutiny of the platform's security.

Security teams and defenders: Given that CISA added GitLab's previous maximum-severity flaw to its exploited vulnerabilities catalog within a day, defenders will be watching closely to see whether this new flaw is already being targeted, and whether public exploit code appears before organisations can patch.

What to Watch

  • Whether CISA adds CVE-2026-97229 to its Known Exploited Vulnerabilities catalog in the coming days, as it did with the September path traversal flaw.
  • Whether public proof-of-concept exploit code emerges for the unauthenticated attack chain.
  • How quickly self-managed customers adopt patched versions, and whether any intrusion reports are traced to the vulnerability.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workSubscribe