Security News GitLab warns of max severity code execution vulnerability

[Brownie2019]

Content source

https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/

GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances.

Tracked as CVE-2026-97229, this critical security flaw was discovered by a security researcher using the 'joaxcar' handle and reported via GitLab's HackerOne bug bounty program.

CVE-2026-97229 stems from an integer overflow weakness in GitLab's CI/CD Regular Expression Compiler, which parses, compiles, and evaluates regular expressions in projects' pipeline configuration files.

"GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation," the company explained in a Monday advisory.

GitLab fixed the security issue in GitLab Community Edition (CE) and Enterprise Edition (EE) versions from 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2, and urged users to patch their servers immediately.

GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances.

 

[Bot]

GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances. Tracked as CVE-2026-97229, this critical security flaw was discovered by a security researcher using the […]

Hi Brownie2019, this deserves emergency treatment on self-managed GitLab, but there is an important update to the versions quoted: GitLab’s current advisory recommends 19.4.2, 19.3.5, or 19.2.8. Version 19.3.4 had a merge-request bug when the Ona integration was enabled, so administrators should not stop there.

CVE-2026-97229 affects:

• 19.2 through 19.2.7
• 19.3 through 19.3.4
• 19.4 through 19.4.1

Although its CVSS vector says no privileges are required, there is some useful nuance. Rapid7 reproduced the complete RCE chain against GitLab 19.4.1, but found that an attacker first needs a way to place a malicious CI/CD configuration in a repository. Instances allowing open self-registration and project creation largely remove that obstacle. Successful exploitation runs commands as the GitLab git user—not automatically as root, but that is still an extremely serious position on a server holding source code, CI secrets and deployment credentials.

For administrators:

1. Upgrade immediately to 19.2.8, 19.3.5, 19.4.2, or a later fixed release.
2. Until patched, restrict self-registration/project creation and unnecessary public access. That reduces exposure but is not a substitute for updating.
3. If the instance was Internet-facing while vulnerable, review new accounts/projects, unusual .gitlab-ci.yml changes, unexpected pipelines, child processes spawned by GitLab services, token creation and anomalous outbound connections.
4. If suspicious activity appears, preserve evidence, isolate the instance and rotate potentially exposed GitLab and CI/CD credentials from a trusted system.

GitLab.com is already patched, and GitLab Dedicated customers do not need to perform the server upgrade. Also, the CISA exploitation paragraph in the report concerns the earlier CVE-2026-85706; it does not by itself establish in-the-wild exploitation of CVE-2026-97229. The latter’s exploitability is nevertheless no longer theoretical—waiting for KEV listing would be an adventurous patch strategy.

Sources

• GitLab Critical Patch Release: 19.4.2, 19.3.4, 19.2.8 | GitLab Docs
• CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab