Attackers have begun exploiting a maximum-severity vulnerability in GitLab that can allow remote code execution, prompting immediate warnings from GitLab and the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The flaw, tracked as CVE-2026-97229, stems from an integer overflow in GitLab’s CI/CD Regular Expression Compiler and can be triggered by a malicious regular expression in a pipeline configuration.
The flaw at a glance
CVE-2026-97229 is an integer overflow weakness in the component that parses, compiles, and evaluates regular expressions used in CI/CD configuration files. According to the disclosure, insufficient validation of those expressions could let a remote, unauthenticated attacker execute arbitrary code on a vulnerable GitLab server via a specially crafted regular expression. The issue was discovered by a researcher using the handle “joaxcar.”
Exposure and impact
GitLab released patches for Community Edition and Enterprise Edition in versions 19.4.2, 19.3.5, and 19.2.8 and urged administrators to apply the fixes immediately. Internet threat tracker Shadowserver reports nearly 2,800 Internet-exposed GitLab Community Edition instances, highlighting the potential reach of successful exploit attempts. Because the vulnerability can lead to remote code execution without authentication, vulnerable instances present a high-risk target for attackers.
GitLab and CISA response
GitLab not only issued the patches but also published threat detections to help customers running self-managed instances identify exploitation attempts. CISA confirmed active exploitation of CVE-2026-97229 and added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog. Under Binding Operational Directive (BOD) 26-04, CISA ordered federal agencies to secure impacted servers by the specified deadline and encouraged private-sector teams to prioritize patching as well.
A pattern of recent GitLab fixes
This vulnerability is the latest in a series of high- and maximum-severity issues GitLab has addressed this year. Earlier fixes included a high-severity two-factor authentication bypass (CVE-2026-0723) and other maximum-severity flaws in the Regular Expression Compiler (CVE-2026-110264) and the repository commits API (CVE-2026-85706), the latter of which could expose sensitive data like credentials. CISA has added multiple GitLab flaws to its exploited list since late 2021, underscoring persistent targeting of the platform.
Takeaway
With active exploitation confirmed and a substantial number of publicly reachable instances, organizations running self-hosted GitLab should treat this advisory as urgent. GitLab’s patches and CISA’s inclusion of CVE-2026-97229 in the KEV Catalog signal both the severity and immediacy of the risk; GitLab and CISA have encouraged administrators and security teams to prioritize applying available updates.
Licensed under CC BY-ND 4.0 International