GitLab urges immediate patching for critical CI/CD regex flaw
GitLab disclosed a maximum-severity flaw, CVE-2026-97229, in its CI/CD Regular Expression Compiler. The bug could let an unauthenticated attacker run arbitrary code on a GitLab server through a crafted regular expression in pipeline configuration. Patches are available in specified CE and EE releases, and self-managed administrators are urged to upgrade immediately.
The maximum-severity flaw, CVE-2026-97229, is an integer overflow in GitLab's CI/CD regular expression compiler. A researcher known as joaxcar found it and reported it through HackerOne. Because pipeline configuration can contain regexes, a malicious expression might trigger code execution without authentication.
Fixes exist in Community and Enterprise Edition releases: 19.2.8, 19.3.4, and 19.4.2 and later. GitLab.com already runs a patched build, and Dedicated customers need not act. Self-managed installations remain the main concern.
Organizations running self-managed GitLab instances could be exposed if they delay upgrades, since a compromised CI/CD server may let attackers alter builds or reach code and secrets. That may ripple to developers, customers, and downstream software users who trust those pipelines. Cloud-hosted GitLab.com users appear less affected because patching is already handled. The broader lesson is that build infrastructure remains a high-value target, so prompt maintenance may reduce supply-chain risk.