GITLAB has patched CVE-2026-97229, a critical remote code execution flaw rated CVSS 10.0 that affects the CI/CD regex compiler. The vulnerability stems from an integer overflow in Onigmo when re-evaluating a crafted UTF-8 repository path during CI linting. An unauthenticated attacker can trigger the flaw by submitting a specially crafted .gitlab-ci[.]yml and repository path to a public project, bypassing initial size checks and the repeat scanner, ultimately allowing arbitrary commands to run as the git user.
Rapid7 researchers disclosed a PoC exploit after the fix, and Censys estimates that tens of thousands of exposed hosts exist, with 25,766 internet-facing hosts and 79,224 web properties currently running vulnerable versions.
Affected self-managed GitLab installations span three release lines: 19.2.0–19.2.7, 19.3.0–19.3.4, and 19.4.0–19.4.1, while GitLab[.]com is already patched. The advisory lists patched versions as 19.2.8, 19.3.5, and 19.4.2. At present, there is no confirmed exploitation in the wild, and the flaw is not yet recorded in the CISA KEV catalog.
Mitigation guidance from the article emphasises upgrading to the patched releases as soon as possible; if patching is not immediate, organisations should restrict inbound access to the GitLab web interface and disable untrusted public project creation to limit exposure while remediation is underway.