Cybersecurity
GitLab patches code execution flaw in CI/CD compiler
GitLab said it had fixed CVE-2026-97229, an integer-overflow flaw in its CI/CD Regular Expression Compiler that could let an unauthenticated attacker run code on affected self-managed servers.
- GitLab said it had fixed CVE-2026-97229, an integer overflow in its CI/CD Regular Expression Compiler.
- It said an unauthenticated attacker could have used a crafted regular expression in CI/CD configuration to run arbitrary code on a GitLab server.
- GitLab said the issue affected Community Edition and Enterprise Edition releases before 19.2.8, 19.3.4 and 19.4.2, while GitLab.com was already patched and GitLab Dedicated customers did not need to act.
- A researcher using the joaxcar handle reported the flaw through GitLab’s HackerOne bug bounty programme.
- CISA said five GitLab flaws had been abused in attacks since November 2021.
GitLab warned users to patch CVE-2026-97229 after it fixed the issue in its CI/CD Regular Expression Compiler. The company said the flaw could have let an attacker run code on a GitLab server.
GitLab said the problem came from an integer overflow in the component that parses and evaluates regular expressions in pipeline configuration files. It said the issue could have been triggered by a specially crafted regular expression under certain conditions.
The company said GitLab Community Edition and Enterprise Edition versions before 19.2.8, 19.3.4 and 19.4.2 were affected. It said GitLab.com was already running the patched version and that GitLab Dedicated customers did not need to take action.
GitLab said a security researcher using the joaxcar handle found the issue and reported it through its HackerOne bug bounty programme. CISA said it had flagged five GitLab flaws that were abused in attacks since November 2021.
Named in this story
People
- joaxcar
- the security researcher handle that reported the issue
Companies
- GitLab
- said it had fixed the flaw and urged users to upgrade
Organisations
- HackerOne
- the bug bounty programme used for the report
Governments and agencies
- CISA
- said five GitLab flaws had been abused in attacks since November 2021
Products and systems
- CVE-2026-97229
- the tracked security flaw in the compiler
- CI/CD Regular Expression Compiler
- the component that contained the integer overflow
- GitLab Community Edition
- one affected edition family
- GitLab Enterprise Edition
- one affected edition family
- GitLab.com
- the hosted service that was already patched
- GitLab Dedicated
- the managed service whose customers did not need to act
How the source tells it
The piece read like an urgent security advisory, with severity labels and immediate patch advice up front, plus a brief self-promotional note about GitLab’s reach.
- urgency repeated instruction to patch immediately and direct guidance for self-managed installations
- alarm severity language and code-execution consequences placed in the lead
- vendor boosterism company scale and customer lists used to underline the platform’s importance