Security experts are expressing concern over a newly disclosed maximum severity vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE), with maintainers of impacted instances being urged to patch now outside of regular patching cycles.
CVE-2026-97229 has a CVSS score of 10 and was disclosed on October 13 as part of a recent GitLab Critical Patch Release.
The vulnerability is an integer overflow or wraparound in GitLab CE and EE’s CI/CD regular expression compiler, and could – under the right conditions – lead to a remote attacker executing arbitrary code on an affected server through a specially crafted regular expression.
CVE-2026-97229 impacts all versions of CE and EE from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. Versions 19.2.8, 19.3.5, and 19.4.2 are all fixed; GitLab.com is already patched, and GitLab Dedicated is also covered.
While no exploitation of the vulnerabilities has been observed as of the time of writing, GitLab is taking the issue seriously.
“These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately,” GitLab said in its Patch Release.
Researchers at Rapid7 Intelligence are similarly concerned and have already reproduced arbitrary code execution on an unpatched GitLab CE image.
“Given the vulnerability's maximum CVSS score, network-accessible trigger, and code execution in a GitLab application worker, Rapid7 recommends upgrading affected self-managed instances on an urgent basis, outside of normal patch cycles,” Rapid7 said in an October 13 blog post.
In its testing, Rapid7 found that so long as an attacker can “commit a malicious CI/CD configuration file .gitlab-ci.yml, and a repository path containing UTF-8 characters to a branch in a public project,” they’re likely to be able to proceed further.
“The crafted regular expression initially compiles in a compact US-ASCII representation and passes GitLab's regular expression validation,” Rapid7 said.
“When it is evaluated against a specially formed, valid UTF-8 repository path, Ruby's Onigmo regular expression engine recompiles it for the new encoding after those checks have completed. An integer overflow in the compiler's program-size calculation then causes invalid regular expression instructions to be generated.
“The resulting loss of control-flow integrity can be used to execute attacker-controlled Onigmo VM operations in the Ruby process and run an operating system command as the GitLab git user.”
If self-managed instances cannot be patched right away, Rapid7 recommends restricting anonymous access to public projects and preventing untrusted users from creating or writing to public projects.
This can reduce exposure, but not prevent it entirely. The best advice for now remains to patch immediately.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
