GitLab has patched a critical flaw in its CI/CD Regular Expression Compiler that could have let an unauthenticated user run arbitrary code on a GitLab server. The bug, tracked as CVE-2026-97229, carries the maximum CVSS 3.1 score of 10.0. It is fixed in GitLab Community and Enterprise Editions 19.4.2, 19.3.5 and 19.2.8, released on Oct. 12, 2026.
According to GitLab, GitLab.com is already running the patched version, and all GitLab Dedicated tenants were patched through an internal release before the public patch release went out. For self-managed installations, GitLab "strongly recommend[s]" upgrading to one of the fixed versions immediately. A CISA assessment attached to the NVD record on Oct. 14 lists the flaw's exploitation status as "none."
The flaw
GitLab's advisory titles CVE-2026-97229 an "Integer Overflow issue in CI/CD Regular Expression Compiler," and the NVD record classifies it as CWE-190 (integer overflow). The NVD entry, published Oct. 13 and since marked as analyzed, says that "under certain conditions," the bug "could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation." The advisory does not describe what those conditions are.
Affected versions are:
- GitLab CE/EE 19.2 before 19.2.8
- GitLab CE/EE 19.3 before 19.3.5
- GitLab CE/EE 19.4 before 19.4.2
The CVSS vector GitLab assigned, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, accounts for the 10.0 score. The flaw can be reached over the network with low attack complexity, the attacker needs no privileges and no user interaction is required. The "scope changed" rating means a successful attack can affect resources beyond the vulnerable component itself, and confidentiality, integrity and availability impacts are all rated high. GitLab credits the researcher joaxcar, who reported the flaw through GitLab's HackerOne bug bounty program.
BleepingComputer's Oct. 12 report lists 19.3.4 as the fixed version for the 19.3 branch. GitLab's release notes and the NVD record both give 19.3.5. GitLab's notes also say 19.3.4 shipped with a bug affecting merge request pages when the Ona integration is enabled, which 19.3.5 fixes.
What else is in the release
The patch release fixes 24 vulnerabilities: one critical, five high, 14 medium and four low. The critical and high-severity issues are:
| CVE | Issue (per GitLab) | Editions | CVSS |
|---|---|---|---|
| CVE-2026-97229 | Integer overflow in CI/CD Regular Expression Compiler | CE/EE | 10.0 |
| CVE-2026-92883 | Cross-site scripting in syntax highlighting | CE/EE | 8.7 |
| CVE-2026-16301 | Improper authorization in downstream pipeline creation service | CE/EE | 8.5 |
| CVE-2026-14814 | Permissive regular expression in repository file access | CE/EE | 8.2 |
| CVE-2026-81839 | Incorrect authorization in scheduled pipeline execution policy | EE | 7.7 |
| CVE-2026-96893 | Improper neutralization of input used for LLM prompting in GitLab Duo Agent Platform | EE | 7.3 |
The medium- and low-severity fixes are mostly authorization problems, in areas such as GraphQL, the package registry, merge request approvals, custom roles and fine-grained personal access tokens. They also include an open redirect in the Kubernetes proxy, a server-side request forgery in repository import and an information exposure issue in GitLab Pages. GitLab's release notes list the affected versions for each fix.
GitLab flaws and the KEV catalog
BleepingComputer reports that GitLab says it has more than 30 million registered users. It also reports that CISA has flagged five GitLab vulnerabilities as exploited in attacks since November 2021, and that ransomware gangs exploited at least one of them.
One of those five is CVE-2026-85706, a separate GitLab flaw rated CVSS 10.0 that was patched in September 2026. CISA describes it as a path traversal bug that lets an unauthenticated user read arbitrary files through the repository commits API. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on Sept. 11, 2026, with a remediation due date of Sept. 14, 2026 for federal civilian agencies. That deadline has passed.
CVE-2026-97229 is not in the KEV catalog.
What It Means for Defenders
- Upgrade self-managed instances to the fixed version for your branch, then confirm the version the instance is actually running. GitLab notes that single-node instances will go down during the upgrade while migrations run. Multi-node instances can use GitLab's zero-downtime upgrade procedures.
- Inventory every GitLab server. Include test, lab and unofficial instances along with production, and record which release branch each one is on so none of them miss the update.
- Limit exposure until you can patch. Keep internet-facing self-managed instances behind a VPN or an IP allowlist, and review who can create or edit projects and pipelines.
- Close out September's flaw too. Instances still running versions affected by CVE-2026-85706 are exposed to a flaw CISA lists as exploited. Watch the KEV catalog in case CVE-2026-97229 is added.
- Review instances that sat unpatched and exposed. Look through recent CI/CD configuration changes and server logs for anything unexpected. If something looks wrong, rotate the CI/CD variables, runner tokens and deploy keys stored on that instance.
