GitLab has disclosed a maximum-severity remote code execution vulnerability (CVE-2026-97229) in its CI/CD Regular Expression Compiler, allowing unauthenticated attackers to execute arbitrary code via crafted regex in pipeline configs. The flaw, caused by an integer overflow, was discovered by a HackerOne researcher and patched in CE/EE versions 19.2.8, 19.3.4, and 19.4.2.
Background
GitLab is a leading web-based DevOps platform used by millions of organizations worldwide for source code management and CI/CD pipelines. This is the latest in a series of critical vulnerabilities GitLab has addressed recently.
- Source
- Lobsters
- Published
- Oct 14, 2026 at 11:55 PM
- Score
- 9.0 / 10