Federal cyber agency warns attackers are exploiting critical GitLab code execution vulnerability

The Cybersecurity and Infrastructure Security Agency warned on Thursday that hackers have begun exploiting a maximum-severity flaw in GitLab, tracked as CVE-2026-97229. GitLab remediated the issue in GitLab Community Edition and Enterprise Edition versions 19.4.2, 19.3.5, and 19.2.8 earlier in the month, but unpatched deployments remain vulnerable to remote code execution. [1][2]

Discovered by a researcher known as joaxcar, the integer overflow weakness sits inside the CI/CD Regular Expression Compiler that parses pipeline configuration files. GitLab explained that insufficient validation could allow an unauthenticated attacker to remotely run arbitrary code on targeted servers using a maliciously crafted regular expression. Following detection of exploitation attempts, the company released threat detections to help customers running self-managed instances defend their systems. [1][2]

CISA added the flaw to its Known Exploited Vulnerabilities Catalog, requiring federal civilian agencies under Binding Operational Directive 26-04 to patch their installations by Sunday while urging private organizations to follow suit. The urgency is heightened given GitLab's footprint of more than 70 million registered users, with internet monitor Shadowserver noting that nearly 2,800 exposed Community Edition instances remain accessible online. [1]