CISA Confirms Active Exploitation of Critical GitLab Vulnerability

Overview of the Security Threat

The US Cybersecurity and Infrastructure Security Agency (CISA) has officially confirmed that attackers are actively exploiting a maximum-severity vulnerability in GitLab. The flaw, tracked as CVE-2026-97229, exists within the CI/CD Regular Expression Compiler and poses a significant risk to unpatched servers.

Technical Details and Impact

Identified by security researcher 'joaxcar', the vulnerability stems from an integer overflow weakness. If exploited, it allows remote, unauthenticated attackers to execute arbitrary code on target instances by injecting maliciously crafted regular expressions into CI/CD configuration files. This occurs due to insufficient validation processes within the compiler.

Remediation and Recommendations

GitLab has released patches to address the issue in the following versions:

• GitLab Community Edition (CE) and Enterprise Edition (EE) 19.4.2
• GitLab CE/EE 19.3.5
• GitLab CE/EE 19.2.8

Admins are urged to upgrade their instances immediately. Additionally, GitLab has provided threat detection resources to assist users with self-managed installations. CISA has added this flaw to its Known Exploited Vulnerabilities (KEV) Catalog and, under Binding Operational Directive (BOD) 26-04, has mandated that US federal agencies secure their systems by the upcoming Sunday deadline. Private sector organizations are also strongly advised to prioritize patching to defend against potential breaches.

Contextual Security Trends

This incident follows a series of recent security challenges for the platform. GitLab has addressed multiple high-severity vulnerabilities throughout the year, including flaws in the repository commits API and two-factor authentication bypasses. Security researchers note that thousands of internet-exposed instances remain, making prompt patching critical for the platform's extensive user base.