Key points
- GitLab released versions 19.4.2, 19.3.5, and 19.2.8 on October 12, 2026, to fix CVE-2026-97229.
- The flaw is an integer overflow in the CI/CD regular-expression compiler, rated CVSS 10.0 by GitLab.
- A public proof-of-concept exists, but GitLab states no wild exploitation was reported at disclosure.
GitLab Community Edition and Enterprise Edition versions 19.2 through 19.4 are affected by CVE-2026-97229, a critical integer overflow in the CI/CD regular-expression handling engine. Patches were released on October 12, 2026, for versions 19.2.8, 19.3.5, and 19.4.2. Organizations running earlier versions in these trains must apply the updates immediately to mitigate the risk of unauthenticated remote code execution.
In plain English
The vulnerability allows an attacker to run commands on a GitLab server without logging in. The flaw occurs when the system processes regular expressions in CI/CD pipeline configurations. By manipulating how the system compiles these expressions, specifically using Unicode characters and hidden quantifier bounds, an attacker can trigger an integer overflow. This overflow bypasses safety checks and leads to arbitrary code execution as the GitLab service account.
The background
Rapid7 researchers published an analysis detailing how the exploit chain moves from repository inputs to native code execution. The issue was reported via HackerOne by researcher joaxcar. Additionally, researcher Jonah Burgess released a public proof-of-concept demonstrating the exploit against the official Linux amd64 GitLab CE 19.4.1 image. The exploit requires the attacker to push a malicious configuration to a public project before triggering the unauthenticated lint endpoint.
What changes now
GitLab has patched its own hosted service, GitLab.com, and confirmed that Dedicated customers do not need to take action. For self-managed instances, the vendor released fixes for the affected version trains. GitLab’s release notes did not report any evidence of exploitation in the wild at the time of disclosure. However, the availability of public exploit code increases the urgency for administrators to verify their patch status and ensure their instances are updated to the latest secure versions.
Who needs to act first
Teams should prioritize updating internet-facing GitLab instances that host public projects, as these are the primary targets for unauthenticated attacks. Before applying patches in production, administrators should test the updates in a staging environment to ensure pipeline compatibility. If immediate patching is not possible, consider restricting write access to public repositories or disabling the CI lint endpoint for unauthenticated users where business logic allows. Monitor system logs for unusual process crashes or HTTP 502 errors that may indicate exploitation attempts.
Background: Unauthenticated remote code execution
Unauthenticated remote code execution often stems from default credentials, exposed management interfaces, and improper input handling. Fix these by enforcing strict authentication, disabling unused services, validating all inputs, and isolating privileged components from public networks.
Read the full guide: Unauthenticated RCE Mistakes: 7 Errors That Expose Your Systems
What to do and how to stay safe: GitLab
- Identify all self-managed GitLab CE and EE instances running versions prior to 19.2.8, 19.3.5, or 19.4.2.
- Apply the latest security patches to affected versions as soon as possible.
- Review public repository permissions to limit the ability of external users to push branches.
- Monitor CI/CD worker logs for crashes or unexpected command executions following lint requests.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this vulnerability affect private GitLab projects?
The public proof-of-concept requires access to a public project to push the malicious configuration, but GitLab states all deployment types are affected unless stated otherwise.
Is there evidence of active exploitation in the wild?
GitLab's release notes did not report exploitation in the wild occurring at the time of disclosure, though a public proof-of-concept has been released.
Which specific versions are patched?
GitLab released patches in versions 19.4.2, 19.3.5, and 19.2.8 on October 12, 2026.
