GitLab has released fixes for a vulnerability that security agencies are treating as an emergency. Tracked as CVE-2026-97229, the flaw sits in GitLab’s CI/CD regular expression compiler and carries a CVSS 3.1 score of 10.0, the maximum. Under certain conditions an unauthenticated attacker can run arbitrary code on a GitLab server by submitting a specially crafted regular expression in a CI/CD configuration file.
The technical problem
The root cause is an integer overflow (classified CWE-190) caused by insufficient validation of regular expressions. That overflow is what lets a crafted expression escape the compiler and execute code with the privileges of the GitLab service. GitLab describes the impact as scope-changed with high confidentiality, integrity and availability impact — meaning a single successful attack can reach beyond the component it starts in.
Which versions are affected
- GitLab CE and EE 19.2 versions before 19.2.8
- GitLab CE and EE 19.3 versions before 19.3.5
- GitLab CE and EE 19.4 versions before 19.4.2
The fixes shipped on October 12, 2026 in versions 19.4.2, 19.3.5 and 19.2.8. That release also addressed 23 other security issues, including a prompt-injection problem in GitLab Duo Agent Platform (CVE-2026-96893, CVSS 7.3, Enterprise Edition) that could cause command execution attributed to other users, and CVE-2026-14814 (CVSS 8.2), which involves poisoning cached raw-file responses so crafted content runs in a victim’s pipeline.
What administrators should do
Self-managed GitLab instances are the exposed population; GitLab’s own guidance is to upgrade immediately rather than schedule the work for a maintenance window. The patch includes database migrations, so a single-node install will see downtime during the upgrade. Back up first, then upgrade, then confirm the version number reported by the instance rather than assuming the package install completed.
For organisations that cannot patch instantly, the practical mitigations are to restrict who can push CI/CD configuration, review unexpected changes to .gitlab-ci.yml files, and watch for unusual outbound connections from the GitLab host. None of those substitutes for the upgrade, because the vulnerability needs no credentials to exploit.
Who is flagging it
CERT-EU published an advisory describing the flaw as critical and noting that it affects self-managed Community and Enterprise Edition instances. Singapore’s Cyber Security Agency issued a parallel alert telling administrators to patch immediately. The CVE record itself lists the affected ranges and the vendor advisory as the authoritative reference.
There is no public report at the time of writing of CVE-2026-97229 being exploited in the wild. Given the score, the absence of authentication requirements and the fact that CI/CD systems typically hold deployment credentials and source code, treating it as urgent is reasonable.
Sources
- GitLab Docs, “GitLab Critical Patch Release: 19.4.2, 19.3.4, 19.2.8”: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
- CVE record for CVE-2026-97229: https://www.cve.org/CVERecord?id=CVE-2026-97229
- CERT-EU security advisory 2026-016: https://cert.europa.eu/publications/security-advisories/2026-016/
- Cyber Security Agency of Singapore alert AL-2026-141: https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-141/
