What Happened
GitLab disclosed CVE-2026-97229, a maximum-severity flaw in its CI/CD Regular Expression Compiler. BleepingComputer reports an integer overflow in the component, which parses and evaluates regular expressions in pipeline configuration files. Insufficient validation lets an unauthenticated user run arbitrary code on the server through a crafted expression under certain conditions.
Affected releases are 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2, in both Community and Enterprise editions. GitLab.com already runs the fix. GitLab Dedicated customers need no action. A researcher using the handle joaxcar reported the flaw through HackerOne. No exploitation is reported and no workaround is listed.
Why This Matters for Canadian Organizations
Self-managed GitLab holds source code, deployment credentials, and secrets for many Canadian teams. A server takeover hands an attacker the pipeline, and the pipeline reaches production. Canadian banks, insurers, and public sector bodies often host GitLab in their own data centres to meet data residency goals and OSFI Guideline B-13 expectations. Those instances sit on your patch list, not GitLab’s.
GitLab flaws draw attackers fast. CISA added a GitLab path traversal flaw to its Known Exploited Vulnerabilities catalog in September after exploitation began within 24 hours of disclosure. Treat this flaw the same way. A breach of a code host also exposes personal information, which brings PIPEDA breach reporting duties.
What to Do
Check your GitLab version today. Upgrade to 19.2.8, 19.3.4, or 19.4.2 or later. Place the instance behind a VPN or an allow list if it faces the internet. Limit who is able to edit CI/CD configuration. Review recent pipeline changes and runner activity for odd regular expression rules. Rotate tokens and secrets stored in the instance if you find signs of compromise. For related coverage, see our TechTalk archive and News archive.
