GitLab warns of max severity code execution vulnerability

GitLab warns of max severity code execution vulnerability By Sergiu Gatlan October 12, 2026 09:09 AM 0 GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances.

GitLab 警告称存在最高严重级别的代码执行漏洞。作者：Sergiu Gatlan，2026 年 10 月 12 日上午 09:09。GitLab 今日警告用户，需立即修复其 CI/CD 正则表达式编译器中一个最高严重级别的漏洞，该漏洞可能允许远程攻击者在目标实例上运行任意代码。

Tracked as CVE-2026-97229, this critical security flaw was discovered by a security researcher using the ‘joaxcar’ handle and reported via GitLab’s HackerOne bug bounty program. CVE-2026-97229 stems from an integer overflow weakness in GitLab’s CI/CD Regular Expression Compiler, which parses, compiles, and evaluates regular expressions in projects’ pipeline configuration files.

该漏洞被追踪为 CVE-2026-97229，由一名使用“joaxcar”网名的安全研究人员发现，并通过 GitLab 的 HackerOne 漏洞赏金计划报告。CVE-2026-97229 源于 GitLab CI/CD 正则表达式编译器中的整数溢出缺陷，该编译器负责解析、编译和评估项目流水线配置文件中的正则表达式。

“GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation,” the company explained in a Monday advisory.

“GitLab 已经修复了一个问题，该问题在特定条件下，由于正则表达式验证不足，可能允许未经身份验证的用户通过 CI/CD 配置中精心构造的正则表达式在 GitLab 服务器上执行任意代码，”该公司在周一的公告中解释道。

GitLab fixed the security issue in GitLab Community Edition (CE) and Enterprise Edition (EE) versions from 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2, and urged users to patch their servers immediately. “These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately,” it warned. “GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.”

GitLab 在 19.2 版本（19.2.8 之前）、19.3 版本（19.3.4 之前）和 19.4 版本（19.4.2 之前）的社区版 (CE) 和企业版 (EE) 中修复了此安全问题，并敦促用户立即修补其服务器。“这些版本包含重要的错误修复和安全补丁，我们强烈建议所有自托管的 GitLab 安装立即升级到这些版本之一，”该公司警告称。“GitLab.com 已经运行了修补后的版本。GitLab Dedicated 客户无需采取任何行动。”

CVE-2026-97229 is the latest in a string of vulnerabilities that GitLab has addressed in recent months. In January, GitLab patched a high-severity two-factor authentication bypass (CVE-2026-0723 that lets attackers who know the target’s account ID circumvent two-factor authentication on community and enterprise edition servers.

CVE-2026-97229 是 GitLab 近几个月来处理的一系列漏洞中的最新一个。今年 1 月，GitLab 修复了一个高严重级别的双重身份验证绕过漏洞（CVE-2026-0723），该漏洞允许知道目标账户 ID 的攻击者绕过社区版和企业版服务器上的双重身份验证。

Last month, it addressed another maximum-severity vulnerability (CVE-2026-85706) in GitLab CE/EE that allows unauthenticated attackers to read sensitive data, such as credentials and other secrets, from vulnerable servers. One day later, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85706 to its catalog of flaws exploited in the wild and ordered federal agencies to secure their systems within three days.

上个月，它修复了 GitLab CE/EE 中的另一个最高严重级别漏洞（CVE-2026-85706），该漏洞允许未经身份验证的攻击者从易受攻击的服务器中读取敏感数据，例如凭据和其他机密信息。一天后，美国网络安全和基础设施安全局 (CISA) 将 CVE-2026-85706 加入其在野利用漏洞目录，并命令联邦机构在三天内保护其系统。

CISA has flagged five GitLab flaws abused in attacks since November 2021, including one that was exploited by ransomware gangs. GitLab says that over 30 million registered users and more than 50% of Fortune 100 companies use its DevSecOps platform, including Nvidia, T-Mobile, Lockheed Martin, Airbus, and Goldman Sachs.

自 2021 年 11 月以来，CISA 已标记了五个在攻击中被利用的 GitLab 漏洞，其中包括一个被勒索软件团伙利用的漏洞。GitLab 表示，超过 3000 万注册用户和超过 50% 的财富 100 强公司使用其 DevSecOps 平台，其中包括英伟达 (Nvidia)、T-Mobile、洛克希德·马丁 (Lockheed Martin)、空中客车 (Airbus) 和高盛 (Goldman Sachs)。