External risk intelligence

GitLab CE/EE Arbitrary Code Execution via Regular Expression Validation Flaw

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-97229

GitLab is a primary collaboration and CI/CD platform frequently deployed as a public-facing web service or API endpoint. Because this vulnerability allows unauthenticated code execution via CI/CD configurations, the exposed surface is effectively a public-facing service accessible to network-based attackers by design in standard deployments.

Integer Overflow

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in GitLab software that could allow an unauthenticated user to execute arbitrary code on the server. The issue stems from insufficient validation of regular expressions within CI/CD configurations, which, under specific circumstances, can be exploited to compromise the server. This could have significant implications for the security and integrity of code repositories and development pipelines.

Unauthenticated users could run code on GitLab servers.
Protects code integrity and development pipeline security.
Confirm relevance and potential exposure to GitLab instances.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by submitting a specially crafted regular expression within a CI/CD configuration. This crafted input, when processed by the GitLab server, would bypass validation checks, leading to arbitrary code execution on the server.

No authentication required.
Crafted regex in CI/CD config.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated user could execute arbitrary code on the GitLab server by providing a specially crafted regular expression in a CI/CD configuration. This could affect the integrity and availability of the GitLab server and any data it processes or stores.

Server code execution.
Via crafted CI/CD regex.
System compromise and data loss.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in GitLab's CI/CD processing requires immediate attention. Platform or infrastructure teams responsible for GitLab instances should initiate an inventory of all deployed GitLab environments. Subsequently, the security team must confirm network reachability and assess business criticality for each instance to prioritize remediation efforts. Coordination with the vendor-management team may be necessary if self-hosted instances are managed by a third party.

Platform/infrastructure teams own remediation.
Verify all GitLab instance reachability and criticality.
Plan for vendor coordination and maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is GitLab CE/EE?

GitLab CE/EE is an integrated software development platform used for version control, managing code repositories, and automating CI/CD pipelines. It acts as a central hub where developers build, test, and deploy applications, making it a critical component of the modern software supply chain.

How does CVE-2026-97229 cause arbitrary code execution?

This vulnerability involves insufficient validation of regular expressions within CI/CD configurations. It is classified as an integer overflow (CWE-190). When the server processes a malicious regex, this flaw allows it to bypass expected memory constraints, ultimately enabling an attacker to run unauthorized commands directly on the host server.

When is an attacker able to trigger this vulnerability?

An attacker can trigger this flaw by submitting a specially crafted regular expression through a CI/CD configuration. Because the validation check is flawed, standard legitimate regex patterns used in normal development workflows do not trigger this issue. The vulnerability specifically requires the submission of a malicious, purposefully designed regex input.

Is my GitLab instance at risk according to Halo Surface Signal?

Halo Surface Signal indicates a high risk because GitLab is commonly deployed as a public-facing service for CI/CD operations. Since this vulnerability does not require authentication to execute, any instance reachable over the network is considered to have a significant exposure surface that could be targeted by unauthorized remote actors.

What should I do to secure my environment from this CVE?

You should immediately identify all self-hosted or managed GitLab instances across your infrastructure. Once inventoried, prioritize these servers for updates based on their business criticality and network exposure. If your instances are managed by a third party, coordinate with them to ensure the required security patches are applied during the next maintenance window.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.