GitLab is urging customers to patch a maximum-severity flaw in its CI/CD Regular Expression Compiler that could allow remote attackers to execute arbitrary code on targeted instances. The vulnerability is tracked as CVE-2026-97229 and affects both GitLab Community Edition (CE) and Enterprise Edition (EE). According to GitLab, the issue stems from an integer overflow weakness in the compiler, which parses, compiles, and evaluates regular expressions in projects' pipeline configuration files.
The flaw was found by a security researcher operating under the handle joaxcar and reported through GitLab's HackerOne bug bounty program. In a Monday advisory, GitLab said that under certain conditions an unauthenticated user could have executed arbitrary code on the GitLab server by way of a specially crafted regular expression in a CI/CD configuration. The company attributed the flaw to insufficient validation of regular expressions.
GitLab said it has fixed the issue in GitLab Community Edition and Enterprise Edition versions 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2. The company strongly recommended that all self-managed GitLab installations be upgraded to one of those versions immediately, describing the releases as containing important bug and security fixes. GitLab said GitLab.com already runs the patched version and that GitLab Dedicated customers do not need to take action.
The disclosure is the latest in a series of security problems GitLab has addressed in recent months. In January, the company patched a high-severity two-factor authentication bypass tracked as CVE-2026-0723 that allows attackers who know a target's account ID to get around two-factor authentication on Community and Enterprise Edition servers. Last month, GitLab addressed another maximum-severity vulnerability, CVE-2026-85706, in GitLab CE/EE that allows unauthenticated attackers to read sensitive data, including credentials and other secrets, from vulnerable servers.
One day after that fix, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85706 to its catalog of flaws exploited in the wild and ordered federal agencies to secure their systems within three days. CISA has flagged five GitLab flaws abused in attacks since November 2021, including one exploited by ransomware gangs. The agency's involvement gives the string of GitLab vulnerabilities a direct federal compliance dimension for U.S. agencies.
GitLab says its DevSecOps platform has more than 30 million registered users and is used by over 50 percent of Fortune 100 companies, naming Nvidia, T-Mobile, Lockheed Martin, Airbus, and Goldman Sachs among its customers.
More cybersecurity news from TechManNews.
