A crafted regex runs code on GitLab servers

CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on Thursday and gave federal agencies until Sunday to patch, under Binding Operational Directive 26-04. The flaw carries GitLab’s maximum severity rating, and it lets a remote attacker run arbitrary code on a GitLab server by feeding it a crafted regular expression in a CI/CD configuration file.

The bug sits in GitLab’s CI/CD Regular Expression Compiler, the component that parses, compiles, and evaluates the regexes in pipeline configuration. A researcher using the handle joaxcar reported it. The root cause is an integer overflow reachable because the expression is not validated sufficiently before compilation. GitLab’s own wording is that “under certain conditions” an unauthenticated user could execute arbitrary code on the server through a specially crafted regular expression. An unauthenticated attacker who supplies pipeline config and reaches that overflow turns a parsing bug into full code execution.

GitLab shipped fixes in Community Edition and Enterprise Edition 19.4.2, 19.3.5, and 19.2.8 earlier this month and told admins to patch at once. It has since released threat detections for self-managed instances after observing exploitation attempts, and CISA’s KEV entry confirms those attempts are landing somewhere.

Shadowserver counts nearly 2,800 internet-exposed GitLab Community Edition instances and does not say how many are already patched. That figure covers only CE and only servers facing the public internet, so the real population of exposed self-managed installs runs higher. Self-managed is the risk surface: those instances depend on their owners to apply the patch, and they are the ones GitLab wrote detections for.

This is the second maximum-severity Regular Expression Compiler RCE GitLab has fixed this month. The earlier one, CVE-2026-110264, carried the same impact: remote code execution through the regex compiler. In September, GitLab patched CVE-2026-85706 in the repository commits API, which could be abused to read credentials and other secrets off a server; CISA added that flaw to KEV a day after watchTowr reported internet-wide scanning for it. In January it fixed a two-factor bypass, CVE-2026-0723, usable by an attacker who already knows the target account ID. CISA has now tagged six GitLab vulnerabilities as exploited in the wild since November 2021.

BOD 26-04 binds only federal agencies, but CISA urged every security team, public and private, to prioritize this one. Get every self-managed instance onto 19.4.2, 19.3.5, or 19.2.8, depending on your release line. If you cannot patch at once, deploy GitLab’s published detections and treat any instance that accepts pipeline configuration from unauthenticated or low-trust users as an active target until it is on a fixed release.