GitLab has addressed CVE-2026-97229, a critical vulnerability in its CI/CD Regular Expression Compiler that could allow an unauthenticated attacker to execute arbitrary code on a vulnerable server.
The vulnerability affects GitLab Community Edition (CE) and Enterprise Edition (EE) and carries a CVSS v3.1 score of 10.0, the highest possible severity rating.
What is the vulnerability?
CVE-2026-97229 is an integer overflow vulnerability associated with insufficient regular-expression validation in GitLab’s CI/CD Regular Expression Compiler.
A specially crafted expression could trigger the vulnerability and potentially lead to remote code execution. Since authentication is not required, vulnerable installations may face significant exposure, particularly when accessible over the internet.
Successful exploitation could put source code, CI/CD infrastructure, and sensitive information accessible to the compromised server at risk. The actual impact would depend on the privileges and integrations associated with the installation.
Affected and fixed versions
The vulnerability affects GitLab Community Edition (CE) and Enterprise Edition (EE).
- GitLab 19.2.x: Versions before 19.2.8 are affected. Upgrade to 19.2.8.
- GitLab 19.3.x: Versions before 19.3.4 are affected. Upgrade to 19.3.4.
- GitLab 19.4.x: Versions before 19.4.2 are affected. Upgrade to 19.4.2.
Administrators should verify their installed versions and apply the appropriate security update or a later supported release containing the fix.
Recommended actions
Organizations running self-managed GitLab should prioritize patching affected instances, particularly those exposed to the internet.
After upgrading, review application and system logs for suspicious activity and check for unexpected changes to CI/CD pipelines. If compromise is suspected, investigate connected runners, repositories, and deployment environments. Rotate potentially exposed credentials when warranted by the investigation.
The available advisory information does not independently establish active exploitation of this vulnerability in the wild.
Conclusion
CVE-2026-97229 highlights the security risks associated with software development infrastructure. A vulnerability in a component that processes CI/CD configurations can potentially expose the server supporting an organization’s software delivery pipeline.
With a CVSS score of 10.0 and no authentication requirement, this vulnerability warrants urgent attention from GitLab administrators.
Official reference: GitLab Critical Patch Release — October 2026
