GitLab Code Execution Flaw Prompts Urgent Patch Warning

A maximum-severity GitLab code execution vulnerability has prompted an urgent warning for administrators running self-managed installations. The flaw could allow remote attackers to execute arbitrary code without signing in.

GitLab disclosed the issue on October 12 and released patches for affected Community Edition (CE) and Enterprise Edition (EE) versions. Meanwhile, GitLab.com already runs the patched software, and GitLab Dedicated customers need no further action.

Vulnerability Affects CI/CD Configuration Processing

The vulnerability, tracked as CVE-2026-97229, involves an integer overflow in GitLab’s CI/CD Regular Expression Compiler. This component processes regular expressions within project pipeline configuration files.

Under certain conditions, an attacker could exploit insufficient validation by placing a specially crafted regular expression inside a CI/CD configuration. As a result, the server could execute attacker-controlled code.

The attack does not require authentication. However, GitLab’s advisory describes exploitation as dependent on specific conditions, rather than possible against every installation in every configuration.

A security researcher reported the issue through GitLab’s HackerOne bug bounty program.

GitLab Code Execution Fixes Cover Three Release Branches

The affected versions span three GitLab release branches. Administrators should check their installed version against these ranges:

• 19.2: Versions before 19.2.8.
• 19.3: Versions before 19.3.4.
• 19.4: Versions before 19.4.2.

GitLab recommends immediately upgrading affected self-managed installations to the appropriate patched release. These updates also include other security and bug fixes.

For organizations using GitLab.com, the platform operator has already applied the update. Similarly, GitLab says Dedicated customers do not need to make changes themselves.

Earlier GitLab Flaws Have Attracted Attacks

The latest warning follows several other serious GitLab security issues this year.

In January, GitLab fixed CVE-2026-0723, a two-factor authentication bypass affecting its community and enterprise editions. That vulnerability allowed attackers who knew a target’s account ID to bypass the additional authentication check.

Then, in September, GitLab addressed CVE-2026-85706, a maximum-severity path traversal flaw. It allowed unauthenticated attackers to access sensitive server data, including credentials and other secrets.

CISA subsequently added that September vulnerability to its Known Exploited Vulnerabilities catalog. The agency also gave federal agencies three days to secure affected systems.

Those exploitation reports concern the earlier path traversal vulnerability. The supplied advisory details do not establish active exploitation of the new regular expression compiler flaw.