GitLab RCE vulnerability: patch now to stop remote code execution

GitLab warned users on Monday about a maximum-severity remote code execution vulnerability in its CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances, according to BleepingComputer. The flaw, tracked as CVE-2026-97229, comes from an integer overflow in the component that parses and evaluates regular expressions in pipeline configuration files.

What happened and who reported it

According to BleepingComputer, the issue was reported through GitLab’s HackerOne program by a researcher using the handle "joaxcar." GitLab’s advisory says the problem could let an unauthenticated user execute code on a GitLab server via a specially crafted regular expression in a CI/CD configuration because of insufficient regular expression validation.

GitLab fixed the issue in Community Edition and Enterprise Edition releases: versions from 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2. The company urged all self-managed installations to upgrade immediately. BleepingComputer reports GitLab.com is already running the patched version, and that GitLab Dedicated customers do not need to take action.

Why the GitLab RCE vulnerability matters to your organization

BleepingComputer notes GitLab says more than 30 million registered users and over half of Fortune 100 companies use its platform. That makes this type of vulnerability attractive to attackers because a compromised instance can expose source code, CI/CD secrets, and deployment systems.

This is also the latest serious GitLab flaw in recent months. BleepingComputer points out previous fixes included a two-factor authentication bypass in January (CVE-2026-0723) and another maximum-severity vulnerability last month that allowed unauthenticated reads of credentials and secrets (CVE-2026-85706). The Cybersecurity and Infrastructure Security Agency added that earlier flaw to its catalog of exploited vulnerabilities and ordered federal agencies to secure affected systems. CISA has flagged multiple GitLab flaws abused in attacks since 2021, including one used by ransomware groups, BleepingComputer reports.

All of that means teams using self-hosted GitLab instances should treat this advisory as high priority, not optional maintenance.

GitLab RCE vulnerability: what to do now

If you manage a self-hosted GitLab instance, take these steps immediately:

• Upgrade your instance to the patched releases GitLab lists (the fixed CE/EE releases cited in the advisory), and follow GitLab’s upgrade guidance. BleepingComputer reports GitLab is urging immediate upgrades.
• If you cannot patch right away, restrict network access to the GitLab server (for example, limit inbound access to known admin IPs or place the instance on a management-only network segment) until you can apply the update.
• Review CI/CD pipeline configuration files for any unexpected or untrusted regular expressions, especially those contributed by external users or third-party projects.
• Rotate credentials and tokens used by the GitLab instance if you suspect unauthorized activity, and reset any exposed secrets found in pipelines.
• Monitor logs and audit trails for signs of exploitation, such as unusual job executions, new pipeline definitions, or unexpected processes running on the server.
• Confirm whether you use GitLab.com or GitLab Dedicated; BleepingComputer reports GitLab.com is already patched and Dedicated customers do not need to act.
• If you want an external check of what your site exposes, consider starting with a free external scan on our security page: /security.html

These are practical mitigations you can apply right away while scheduling a full upgrade and post-patch review.

How this kind of flaw is exploited

The issue stems from an integer overflow in a regular expression compiler used by GitLab’s CI/CD system. BleepingComputer explains the component parses, compiles, and evaluates regular expressions in pipeline configs, and insufficient validation can allow a specially crafted regular expression to cause the overflow and enable arbitrary code execution. Because the attack vector is a CI/CD configuration file, an attacker who can submit pipeline definitions or influence project configuration could try to weaponize such a regex.

That attack path is concerning because CI/CD systems often have access to build environments, deployment credentials, and other project secrets, so a successful exploit can escalate from code execution on the GitLab server to broader compromise.

Longer term measures and monitoring

Treat GitLab advisories as operational security items. Keep self-hosted instances on a supported upgrade path and subscribe to GitLab security announcements. BleepingComputer’s reporting on recent GitLab flaws and CISA’s catalog of exploited vulnerabilities underlines that these issues can be targeted in the wild.

After you patch, confirm the upgrade completed cleanly, review pipeline definitions and repository hooks for unexpected changes, and continue monitoring audit logs. For public sector teams, coordinate with your vulnerability response contacts; for small business and nonprofit owners, work with your hosting or DevOps provider to confirm the update and follow-up checks were completed.

If you need a quick external view of your site or hosting exposure, start with a free external scan on our security page: /security.html

For further reading, see the original BleepingComputer report on this advisory: https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine