Skip to main content

2026-10-12 | GitLab warns of max severity code execution vulnerability

1. AI Summary

GitLab issued an urgent advisory to patch a critical integer overflow flaw (CVE‑2026‑7229) in its CI/CD regular expression compiler that could allow remote code execution. The vulnerability affects self‑managed instances running versions before specific patches (19.2.8, 19.3.4, 19.4.2) and was discovered via HackerOne by researcher 'joaxcar'. The fix is already deployed on GitLab.com and dedicated customers are unaffected, while over 30 million users, including major firms like Nvidia and Goldman‑Sachs, are urged to upgrade immediately.

2. IOCs

IOC Type Value Description Relevant MITRE ATT&CK Techniques
Domain
gitlab.com
 Legitimate GitLab service domain used by the vendor and may be referenced in malicious activity. T1071
Vulnerability CVE-2026-97229 Critical integer overflow vulnerability in GitLab CI/CD Regular Expression Compiler enabling remote arbitrary code execution. T1190|T1059

3. MITRE ATT&CK

Code Title
T1190 Exploitation of externally accessible application to achieve remote code execution
T1059 Execution of commands via scripting interpreter after exploiting the flaw

4. Targets

Type Value
Company Airbus
Company Goldman Sachs
Company Lockheed Martin
Company Nvidia
Company T-Mobile

5. Article Details

6. Original text

GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances. Tracked as

CVE-2026-97229
, this critical security flaw was discovered by a security researcher using the ' joaxcar ' handle and reported via GitLab's HackerOne bug bounty program.
CVE-2026-97229
stems from an integer overflow weakness in GitLab's CI/CD Regular Expression Compiler, which parses, compiles, and evaluates regular expressions in projects' pipeline configuration files. "GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation," the company explained in a Monday advisory. GitLab fixed the security issue in GitLab Community Edition (CE) and Enterprise Edition (EE) versions from 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2, and urged users to patch their servers immediately. "These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately," it warned. "
gitlab.com
is already running the patched version. GitLab Dedicated customers do not need to take action."
CVE-2026-97229
is the latest in a string of vulnerabilities that GitLab has addressed in recent months. In January, GitLab patched a high-severity two-factor authentication bypass (CVE-2026-0723 that lets attackers who know the target's account ID circumvent two-factor authentication on community and enterprise edition servers. Last month, it addressed another maximum-severity vulnerability (CVE-2026-85706) in GitLab CE/EE that allows unauthenticated attackers to read sensitive data, such as credentials and other secrets, from vulnerable servers. One day later, the U.S.

Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85706 to its catalog of flaws exploited in the wild and ordered federal agencies to secure their systems within three days. CISA has flagged five GitLab flaws abused in attacks since November 2021, including one that was exploited by ransomware gangs. GitLab says that over 30 million registered users and more than 50% of Fortune 100 companies use its DevSecOps platform, including

Nvidia
, 
T-Mobile
,
Lockheed Martin
,
Airbus
, and
Goldman Sachs
. Build your security blueprint for AI-powered attacks Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Save your seat