Overview
- GitLab released fixed Community and Enterprise builds and confirmed GitLab.com is already running the patched code, urging all self‑hosted servers to update to the patched versions without delay.
- The flaw is tracked as CVE-2026-97229 and is caused by an integer overflow in the CI/CD Regular Expression Compiler that parses and compiles pipeline regular expressions.
- Under certain conditions the vulnerability could allow an unauthenticated attacker to execute arbitrary code on a vulnerable GitLab server by submitting a specially crafted regular expression in a CI/CD configuration.
- The issue was reported through GitLab’s HackerOne program and credited to the researcher using the handle 'joaxcar'.
- Security teams should treat this as urgent because GitLab is widely used by large firms, past GitLab bugs have been added to CISA’s exploited‑vulnerabilities catalog, and administrators should patch, review CI/CD configs, and check logs for suspicious activity.