GoKawiilGitLab patches critical remote code execution flaw CVE-2026-97229
GitLab issued an advisory urging immediate patching of a maximum-severity vulnerability in its CI/CD Regular Expression Compiler, tracked as CVE-2026-97229. The flaw, an integer overflow found by researcher 'joaxcar' through HackerOne, could let an unauthenticated attacker execute arbitrary code via a crafted regular expression in a CI/CD configuration file. GitLab fixed the issue in versions 19.2.8, 19.3.4, and 19.4.2, noting GitLab.com and Dedicated customers are already protected.
GoKawiil's interpretation of the reporting above, not reported fact.
The unauthenticated nature of the exploit means attackers would not need valid credentials to target self-managed GitLab servers, making rapid patching especially urgent. This marks the third serious GitLab vulnerability disclosed in recent months, following a 2FA bypass and a separate maximum-severity data-exposure flaw, suggesting ongoing scrutiny of the platform's security posture as it remains a high-value target given its widespread use in software supply chains.
- CVE-2026-97229 is a maximum-severity flaw allowing unauthenticated remote code execution via GitLab's CI/CD Regex Compiler.
- Fixes are available in versions 19.2.8, 19.3.4, and 19.4.2; self-managed instances must update immediately.
- It's the third major GitLab vulnerability disclosed in recent months, following a 2FA bypass and a data-exposure bug.
Source: bleepingcomputer.com, 2026-10-12
Published there as: “GitLab warns of max severity code execution vulnerability”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.