A severe remote code execution vulnerability in GitLab has gone public following the release of a proof-of-concept exploit. Identified as CVE-2026-97229 and carrying a maximum CVSS score of 10.0, the flaw affects both GitLab Community Edition (CE) and Enterprise Edition (EE), and poses a real risk for any deployment that hasn’t yet applied the latest patches.
What the Vulnerability Does
The flaw lies in GitLab’s CI/CD regular-expression compiler. The exploit chain works by having an attacker push a specially crafted branch to a public project. This branch contains a pipeline configuration file that includes malicious regular expressions against repository paths. By leveraging a Unicode-encoded path, the attacker triggers a second compilation of the expression after GitLab’s usual size check. That leads to an integer overflow that effectively redirects execution flow into parts of code that can execute arbitrary commands.
Tests show that the exploit typically causes the worker process to crash, returning an HTTP 502 error. However, callback-backed output proves that the command execution step can succeed. The PoC requires substantial memory and is tailored to a specific Linux amd64 build (GitLab CE 19.4.1), so configurations with limited memory or differing builds may experience failures or service disruption instead. The author is continuing to analyze alternate configurations and attack paths for this vulnerability.
Who’s Affected & How to Mitigate
GitLab CE versions 19.2 up to (but not including) 19.2.8, versions 19.3 before 19.3.5, and 19.4 versions prior to 19.4.2 are all vulnerable. Fixed releases for all these branches were made available on October 12, 2026. GitLab.com has already been patched, and dedicated customer instances were not impacted by this specific vulnerability.
Admins are strongly advised to confirm their version and upgrade to 19.2.8, 19.3.5, 19.4.2, or a newer supported release. It’s also recommended to review recent changes in CI/CD configuration, especially new or modified regular expressions and any branches that have undergone recent updates. Public projects, in particular, should be scrutinized since the exploit demands write access to a public project branch.
Severity & Risk Profile
This is a critical vulnerability with potentially wide impact. The exploit path doesn’t require administrative privileges—write access to a public project branch is enough. The published PoC demonstrates a clear path from that level of access to arbitrary command execution on the server. While there is no evidence yet of this being used in live attacks, the availability of exploit code significantly increases risk for unpatched systems.
The crash-inducing behavior also means attacks could be noisy. That could provoke detection, but also unintentional disruptions especially under low memory or high concurrency. Environments with resource constraints may suffer more severe instability.
Actionable Advice: Upgrade immediately, assess your public project permissions, audit recent CI/CD regex changes, and monitor server behavior for unexpected crashes or signs of abuse.
While this vulnerability doesn’t yet appear in active attack reports, the publication of a functional exploit transforms it from theory to urgent priority. Organizations that delay patching are effectively leaving a door open, especially for moderately positioned attackers. Moving forward, we’ll need to watch closely for real-world exploits. The broader lesson: regex handling, especially in CI/CD pipelines, continues to be a serious area of risk that demands constant attention.
