GitLab patches critical flaw allowing remote code execution
GitLab has issued patches for a critical vulnerability (CVE-2026-97229) that could let unauthenticated remote attackers execute arbitrary code on GitLab servers via crafted CI/CD configuration files. The flaw, found in the Regular Expression Compiler, affects multiple recent versions of both Community and Enterprise editions. GitLab urges all self-managed users to upgrade immediately. Managed GitLab.com and Dedicated installations are already secured, requiring no action from customers.
- Unauthenticated attackers could exploit CI/CD config files
- Integer overflow in Regular Expression Compiler is the cause
- Patched in CE/EE 19.2.8, 19.3.4, and 19.4.2
- No action required for GitLab.com or Dedicated customers
Sources covering this
In this story
More in Cybersecurity
Cyberattack disrupts refrigeration at French supermarkets
A cyberattack hit refrigeration systems at hundreds of French supermarkets, including Intermarché, Leclerc, and Coopérative U, after…
UK to tighten cyber defences as AI risks escalate
The UK's AI minister called for tougher safety standards from leading AI firms as the government plans to enhance national cyber…
Google fixed major DevSite RCE flaw after two months
Google took two months to fix a critical vulnerability in its developer documentation platform, DevSite, after a researcher discovered…
Researchers find Windows malware using Tox for control
Security researchers have identified AvisLoader, a new Windows malware loader that uses the encrypted Tox peer-to-peer messaging network…