GitLab has unveiled a high-severity vulnerability—CVE-2026-97229—that permits unauthenticated attackers to execute arbitrary code on affected servers. The issue impacts both Community Edition (CE) and Enterprise Edition (EE), and GitLab issued patches on October 12, 2026. With a maximum severity rating (CVSS 10.0), the flaw allows malicious payloads through regular expressions in CI/CD pipelines. Administrators are urged to update immediately to protect systems. on GitLab.com the fix is already live and Dedicated customers are unaffected.
What Went Wrong
The root cause is an integer overflow in GitLab’s CI/CD regex compiler. A specially crafted regular expression in a CI/CD configuration could bypass validation and trigger execution of arbitrary code on the server. Unlike prior bugs, this one does not require any kind of login or account access. The vulnerability scores high across all impact areas—confidentiality, integrity, and availability—which heightens the risk profile for organizations running self-managed GitLab servers.
Who’s Affected and What to Do
Affected versions include CE/EE releases from 19.2 prior to 19.2.8, from 19.3 prior to 19.3.4, and from 19.4 prior to 19.4.2. Administrators must upgrade to those patched versions without delay. GitLab reports that hosted GitLab-com environments have already been upgraded, and Dedicated customers are not exposed.
In the same security rollout, GitLab also addressed other serious concerns including cross-site scripting, authorization failure, and vulnerabilities in the Duo Agent Platform. A minor bug in version 19.3.4 affecting merge request pages with the Ona integration is known, with fixes expected in 19.3.5.
Why This Matters
Server-side code execution vulnerabilities of this sort are especially dangerous. An attacker exploiting this flaw could compromise the entire GitLab instance—the projects, data, and operations—without needing any user authentication or interaction. That puts organizations’ internal and external development workflows at risk.
GitLab credits a security researcher known as joaxcar via its HackerOne bug bounty program for uncovering CVE-2026-97229. Previous regex-related vulnerabilities patched in September required authenticated access. This new flaw breaks that pattern by allowing code execution from unauthenticated actors.
Administrators should check their deployment versions immediately, schedule updates, and test after patching—especially those using Ona integration on affected releases. Reviewing the full advisory will help with comprehensive defensive measures.
Unless organizations act quickly, this vulnerability could be a vector for serious breaches, data leaks, or even full system compromise. Keep an eye on additional patches and potential secondary bugs in related components like regex or CI/CD. What’s happening here underscores how critical rigorous input validation is—and how dangerous things become when that validation fails.
