Science & Tech · Cybersecurity · 5 hrs ago
GitLab urges users to patch critical code execution flaw
GitLab has fixed a critical security flaw in its software development platform.
The flaw could let an attacker without an account run code on a vulnerable GitLab server by submitting a specially crafted regular expression in a CI/CD configuration.
CI/CD tools help teams automate the building and testing of software.
The issue affects certain versions of GitLab Community Edition and Enterprise Edition.
GitLab says users running those self-managed versions should upgrade immediately to a patched release.
GitLab.com is already patched, and GitLab Dedicated customers do not need to take action.
The flaw matters because running attacker-controlled code on a server could put the system and its data at risk.
GitLab urged users to immediately patch a critical flaw that could let unauthenticated attackers run arbitrary code on affected servers.
The vulnerability affects the CI/CD Regular Expression Compiler and is tracked as CVE-2026-97229.
GitLab said the issue was fixed in specified versions of Community Edition and Enterprise Edition.
GitLab.com is already running a patched version, and GitLab Dedicated customers do not need to act.
The flaw was reported through GitLab’s HackerOne bug bounty program by a researcher using the handle “joaxcar.”
- Who
- GitLab users, particularly operators of affected self-managed installations.
- What
- GitLab urged users to patch CVE-2026-97229, a flaw that could let unauthenticated attackers execute arbitrary code.
- When
- GitLab issued an advisory on Monday; the article was published October 12, 2026.
- Where
- Affected GitLab Community Edition and Enterprise Edition servers.
- Why
- The flaw could allow remote attackers to run arbitrary code through a specially crafted regular expression in a CI/CD configuration.
This story does not have two clearly opposing sides.
GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately.
GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.
GitLab patched a high-severity two-factor authentication bypass, CVE-2026-0723.
GitLab addressed another maximum-severity flaw, CVE-2026-85706, which could let unauthenticated attackers read sensitive data.
CISA added CVE-2026-85706 to its catalog of flaws exploited in the wild and ordered federal agencies to secure their systems within three days.
GitLab issued an advisory about CVE-2026-97229 and urged users to install patched versions.
- Vulnerability
- CVE-2026-97229
- Affected component
- CI/CD Regular Expression Compiler
- Affected versions
- CE and EE 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2
- Researcher
- joaxcar
- Fixed services
- GitLab.com is patched; GitLab Dedicated customers do not need to act
Sources
Related news
Cyberattack defrosts refrigerators at French supermarket chains
Ledger confirms tampered wallets linked to CryptoBilis fund thefts
Malware incident at contractor may expose 8.7 million karaoke records
Critical SonicWall flaw faces exploitation days after patch
Cyberattack disrupts refrigeration systems at French supermarkets
Albert Heijn systems remain offline after cybersecurity incident
Canadian cybersecurity executive arrested on federal extortion charges
Attacks disrupt Yandex services and its data centers in Russia
Canadian cybersecurity executive arrested in FBI ShinyHunters investigation
Cyberattacks disrupt French supermarket freezers and Dutch-Belgian retail operations
Exposure management shifts cybersecurity focus from controls to risk
