GitLab has released patches for a critical vulnerability affecting its CI/CD Regular Expression Compiler that could enable remote code execution on unpatched instances. Designated CVE-2026-97229, the flaw was identified by security researcher 'joaxcar' and submitted through GitLab's HackerOne bug bounty program.

The vulnerability stems from an integer overflow condition in the compiler, which handles parsing, compilation, and evaluation of regular expressions found in project pipeline configuration files. According to GitLab's advisory, the issue permits unauthenticated users to execute arbitrary code on affected servers by supplying a specially constructed regular expression in a CI/CD configuration due to inadequate validation of regex patterns.

GitLab has released patched versions across both Community Edition and Enterprise Edition: versions 19.2.8 and later, 19.3.4 and later, and 19.4.2 and later. The company emphasized the urgency of the situation, stating that GitLab.com is already running the fixed version. Self-managed deployments require immediate action, though GitLab Dedicated customers are unaffected.

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately.

GitLab

This disclosure represents the latest in a series of significant security issues GitLab has addressed recently. In January, the company patched CVE-2026-0723, a high-severity flaw enabling two-factor authentication bypass on both community and enterprise instances when attackers possess a target's account identifier. The following month brought CVE-2026-85706, another maximum-severity vulnerability permitting unauthenticated access to sensitive information including credentials and secrets stored on vulnerable systems.

The U.S. Cybersecurity and Infrastructure Security Agency responded to CVE-2026-85706 by adding it to its Known Exploited Vulnerabilities catalog and mandating that federal agencies remediate their systems within three days. Since November 2021, CISA has documented five GitLab vulnerabilities being actively exploited in the wild, with at least one targeted by ransomware operations.

GitLab's platform serves over 30 million registered users and is deployed across more than half of Fortune 100 companies, including Nvidia, T-Mobile, Lockheed Martin, Airbus, and Goldman Sachs.