CVE-2026-97229: GitLab CI/CD Regular Expression Compiler Remote Code Execution

Impacted systems

Exploitation conditions

According to GitLab, under certain conditions an unauthenticated attacker could exploit insufficient regular-expression validation by supplying a specially crafted regular expression in a CI/CD configuration. Successful exploitation could result in arbitrary code execution on the GitLab server. The advisory does not establish that exploitation is occurring in the wild.

Recommended action

• Immediately upgrade self-managed GitLab CE/EE installations to the applicable fixed release: 19.2.8, 19.3.5, or 19.4.2. Use the latest supported patch release for your branch where available.
• Inventory all self-managed GitLab instances and verify their exact versions, including secondary or less-visible instances.
• Prioritise internet-facing GitLab instances and systems that host sensitive source code, CI/CD secrets, deployment credentials, or production build infrastructure.
• After patching, review GitLab, reverse-proxy, operating-system, and CI/CD-related logs for unusual requests, unexpected process execution, or unexplained changes. Investigate suspicious findings and rotate potentially exposed credentials where warranted.
• Track the patch through change management and confirm that the running instance reports the expected fixed version.

Workarounds

• GitLab's advisory recommends upgrading and does not document a confirmed workaround for this vulnerability. If immediate patching is not possible, restrict access to the GitLab instance to trusted networks and users as a temporary exposure-reduction measure; this is not a substitute for patching.

Sources

• GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8 (official advisory) ↗
• BleepingComputer: GitLab warns of max severity code execution vulnerability ↗
• The Hacker News: GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code ↗