GitLab has warned self-managed users to immediately patch a maximum-severity flaw in its CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances. Tracked as CVE-2026-97229, the critical integer-overflow issue allows "an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation". It was discovered by a security researcher via GitLab's HackerOne bug bounty and is fixed in Community and Enterprise Editions from 19.2 before 19.2.8, 19.3 before 19.3.4 and 19.4 before 19.4.2; GitLab.com and Dedicated are already patched. GitLab says more than 30 million registered users and over half of the Fortune 100 run its DevSecOps platform, and CISA has flagged five GitLab flaws abused since November 2021 — including one exploited by ransomware gangs. The advisory follows a string of GitLab fixes, including last month's CVE-2026-85706 maximum-severity path-traversal flaw which CISA added to its exploited-in-the-wild catalog and ordered federal agencies to patch within three days.

• Source article