Executive Summary

A maximum-severity vulnerability (CVE-2026-97229, CVSS 10.0) was disclosed affecting GitLab Community Edition (CE) and Enterprise Edition (EE), allowing attackers to execute arbitrary code on GitLab servers via specially crafted regular expressions in CI/CD pipeline configurations. Due to the potential for full server compromise and downstream supply-chain impact, immediate patching is required.

About CVE-2026-97229

The issue originates from the CI/CD Regular Expression Compiler component, where an integer overflow (CWE-190) in the parser that compiles regular expressions from pipeline configuration files leads to memory corruption and arbitrary code execution. By committing a specially crafted regular expression in a .gitlab-ci.yml file combined with a repository path containing UTF-8 characters, attackers can gain OS-level code execution as the git user, potentially cascading into build pipeline compromise, secret exfiltration from CI/CD variables, and lateral movement into cloud workloads. No authentication is required to exploit this issue on instances that allow public project creation or user self-registration.

Affected Systems

The following components are affected: GitLab CE and GitLab EE, versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. These components power the CI/CD pipeline engine used across development teams and DevOps workflows, particularly when pipeline configurations containing regular expressions are processed. GitLab.com (SaaS) is already patched. GitLab Dedicated customers require no action. Self-managed instances are at highest risk, especially those with public-facing project creation enabled.

Users should upgrade immediately to GitLab 19.4.2, 19.3.5, or 19.2.8 depending on their version branch. GitLab has published no workaround for this vulnerability. As interim mitigations, organizations should restrict anonymous access to public projects, prevent untrusted users from creating or writing to public projects, and disable user self-registration where not needed. Teams should also review recent CI/CD configuration changes for unexpected or suspicious regular expressions and rotate CI/CD secrets if compromise is suspected.

Risk Impact

Successful exploitation could allow attackers to execute arbitrary commands on the GitLab server, exfiltrate CI/CD secrets and source code from build pipelines, and potentially pivot into cloud infrastructure deployed from compromised pipelines, leading to service disruption, data exposure, or full infrastructure compromise.

At the time of writing, Rapid7 has independently reproduced the vulnerability and published a proof-of-concept demonstrating arbitrary code execution on an unpatched official GitLab CE 19.4.1 image with ASLR enabled. No confirmed in-the-wild exploitation has been reported, though a prior GitLab max-severity flaw (CVE-2026-85706) saw in-the-wild probing within hours of public disclosure and was later added to CISA’s KEV catalog. Regardless, the severity and ease of exploitation make this vulnerability high risk, especially in internet-facing deployments.

How Orca Can Help

Orca enables customers to quickly identify assets running vulnerable GitLab versions, understand their exposure in context — including internet accessibility, runtime reachability, and asset criticality — and prioritize remediation based on real risk rather than CVSS alone. Orca’s platform highlights affected assets directly in the newItem view, helping security teams focus on the most critical remediation paths first.