NEW DELHI — Cybercriminals are actively exploiting a critical vulnerability discovered in GitLab that allows remote attackers to execute arbitrary code without entering valid login credentials or maintaining an active account. In response to confirmed malicious activity targeting the software development platform, the US Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalogue on Thursday. The federal cybersecurity authority directed US government bodies to patch exposed systems immediately while urging corporate network administrators worldwide to prioritize applying the latest security updates.
Flaw Traced to CI/CD Regular Expression Compiler
Tracked as CVE-2026-97229, the security flaw exists within GitLab’s CI/CD Regular Expression Compiler, a core component responsible for parsing, compiling, and evaluating regular expressions defined in automated pipeline configuration files. The vulnerability was discovered and reported by a security researcher known by the handle ‘joaxcar’. Technical evaluations show the defect originates from an integer overflow triggered by insufficient input validation. By feeding a specially crafted regular expression into a project pipeline configuration, remote threat actors can exploit the arithmetic error to execute arbitrary code directly on vulnerable servers under specific operating conditions.
Successful exploitation exposes organizational code repositories, underlying software build environments, and sensitive enterprise data to unauthorized compromise. While the technical nature of the bug creates an opportunity for hostile actors to seize operational control of hosting environments, official disclosures do not point to confirmed instances of data exfiltration or total server takeovers tied directly to this vulnerability.
Patches Rolled Out Across Three Versions
GitLab moved to eliminate the attack vector by publishing emergency maintenance updates for both Community Edition and Enterprise Edition deployments. Patched builds have been issued for versions 19.4.2, 19.3.5, and 19.2.8. Platform administrators managing self-hosted instances have been instructed to apply these releases without delay. The company also circulated threat-detection signatures to help customers audit self-managed installations after initial indicators of real-world exploitation were confirmed.
Federal agencies operating vulnerable software face a mandatory remediation timeline under CISA’s Binding Operational Directive BOD 26-04, which requires unpatched endpoints to be secured by Sunday. Although the administrative mandate carries legal authority only across the US federal civilian executive branch, cybersecurity officials emphasized that private enterprises using GitLab must treat the rollout with equal urgency given the ongoing malicious activity across public networks.
Thousands of Exposed Servers Face Heightened Threat
Telemetry gathered by internet monitoring group Shadowserver shows that roughly 2,800 GitLab Community Edition deployments are directly reachable across the public internet. It remains uncertain how many of these systems have received the latest security revisions. Software instances left directly exposed to public networks represent accessible targets for opportunistic scanning, leaving unpatched organizations vulnerable to automated intrusions until proper updates are verified.
The alert follows a sequence of severe security problems uncovered across the software platform over recent months. In January, GitLab resolved CVE-2026-0723, a high-severity flaw enabling attackers armed with a victim’s user identifier to bypass two-factor authentication safeguards. Earlier this month, engineers addressed another maximum-severity remote code execution flaw, CVE-2026-110264, within the Regular Expression Compiler. Around two weeks later, the company corrected CVE-2026-85706, a critical defect in the Repository Commits API that exposed private credentials and server secrets, which was also cataloged by CISA following reports from security firm watchTowr. CISA has logged six actively exploited GitLab vulnerabilities since November 2021, presenting sustained security challenges for a global DevSecOps ecosystem supporting over 70 million registered users and more than half of the Fortune 100.
