Critical GitLab Vulnerability Enables Arbitrary Code Execution Attacks on Servers

GitLab has released urgent security updates to fix a critical vulnerability that could allow attackers to execute arbitrary code on affected servers without logging in.

Tracked as CVE-2026-97229, the flaw carries the maximum CVSS score of 10.0 and affects both GitLab Community Edition and Enterprise Edition. The company released patches on October 12, 2026.

The vulnerability involves an integer overflow in GitLab’s CI/CD regular expression compiler. GitLab says insufficient regular expression validation could allow an unauthenticated attacker to trigger code execution through a specially crafted expression inside a CI/CD configuration. Regular expressions are text patterns used to match or filter data. Here, processing a malicious pattern could compromise the GitLab server itself.

According to GitLab’s security advisory, exploitation is possible under certain conditions. The published description does not provide a complete attack sequence or identify the exact conditions required.

However, the CVSS vector indicates network access, low attack complexity, no required privileges, and no user interaction. It also assigns high impact to confidentiality, integrity, and availability.

This is server-side code execution, rather than malicious JavaScript running in a visitor’s browser. That difference makes the issue particularly serious for organizations hosting development projects on affected GitLab installations.

Successful exploitation could threaten the server’s data and operation. The release notice does not state that attackers have exploited this vulnerability in real-world attacks.

GitLab credited security researcher joaxcar with reporting the issue through its HackerOne bug bounty program. The company previously patched critical GitLab CI/CD regex vulnerabilities in September.

Those earlier flaws required authentication, while the newly disclosed issue could allow exploitation without an account. The advisory does not establish whether these vulnerabilities share the same underlying cause.

Affected Versions and Required Updates

The affected releases are GitLab CE and EE versions from 19.2 before 19.2.8, from 19.3 before 19.3.4, and from 19.4 before 19.4.2. Administrators should upgrade affected self-managed installations immediately to the corresponding patched release. GitLab.com already runs the patched version, and GitLab Dedicated customers do not need to take action.

The release also addresses other security weaknesses, including cross-site scripting, authorization failures, and a prompt-related issue in GitLab Duo Agent Platform. Earlier GitLab security updates covering CI/CD authorization flaws show why administrators should review the full patch notice rather than focus only on the headline vulnerability.

GitLab warns that version 19.3.4 has a known bug affecting merge request pages when the Ona integration is enabled. A fix is planned for 19.3.5.

Administrators should account for this issue during upgrades without overlooking the urgent security fix. GitLab’s linked instance security guidance provides broader protection advice.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup into your SOC