Active exploitation of a critical GitLab security flaw has been confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA), which added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on Thursday. Identified as CVE-2026-97229, the flaw was discovered by security researcher 'joaxcar' and stems from an integer overflow weakness in the CI/CD Regular Expression Compiler.
The vulnerability affects the component responsible for parsing, compiling, and evaluating regular expressions within pipeline configuration files. An unauthenticated attacker can leverage a specially crafted regular expression to execute arbitrary code on vulnerable GitLab instances due to insufficient validation of expressions.
GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
GitLab
Patching Timeline and Scope
GitLab released patches for both Community Edition (CE) and Enterprise Edition (EE) in versions 19.4.2, 19.3.5, and 19.2.8 earlier this month. The company has also deployed threat detections to assist customers managing self-hosted instances following discovery of exploitation activity.
CISA issued a Binding Operational Directive (BOD) 26-04 requiring federal agencies to secure their systems by Sunday. While this mandate applies specifically to government entities, CISA has called on all organizations, including private sector security teams, to prioritize remediation to defend against ongoing attacks.
According to Internet threat monitoring firm Shadowserver, approximately 2,800 Internet-exposed GitLab Community Edition instances exist, though the number of systems already patched remains unknown.
Pattern of Critical Issues
CVE-2026-97229 represents the latest in a series of significant vulnerabilities GitLab has addressed since the beginning of the year. In January, the company patched a high-severity two-factor authentication bypass (CVE-2026-0723) that allowed attackers with knowledge of a target's account ID to circumvent the authentication mechanism.
Earlier this month, GitLab fixed a maximum-severity Regular Expression Compiler flaw (CVE-2026-110264) permitting remote code execution. Approximately two weeks later, the company released patches for another maximum-severity vulnerability (CVE-2026-85706) affecting the repository commits API, which could be exploited to extract sensitive information including credentials and secrets from affected servers.
CISA added CVE-2026-85706 to its actively exploited vulnerabilities list one day after GitLab's patch release, following a report from cybersecurity firm watchTowr documenting that attackers had begun reconnaissance scanning for unpatched GitLab instances.
Since November 2021, CISA has documented six GitLab vulnerabilities as exploited in active attacks, including two instances (CVE-2021-22175 and CVE-2021-39935) identified in February of this year.
Scale of Deployment
GitLab's DevSecOps platform maintains significant presence across enterprise environments, with deployment across more than 50% of Fortune 100 companies and a global user base exceeding 70 million registered accounts.