A Vulnerability in GitLab Could Allow for Remote Code Execution

A vulnerability has been discovered in GitLab that could allow for remote code execution. GitLab is a DevOps platform that provides source code management, CI/CD pipelines, issue tracking, and collaboration tools in a single application for software development teams. Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration. Successful exploitation could result in complete compromise of the affected system.

Public reporting indicates that exploitation attempts have been observed following disclosure of the vulnerability. For example, Alpine Linux reported attempted exploitation of its GitLab instance on October 20-21, 2026.

GitLab has identified an issue in GitLab CE/EE that, under certain conditions, could allow an unauthenticated user to execute arbitrary code on the GitLab server through a specially crafted regular expression within a CI/CD configuration. The vulnerability is the result of insufficient regular expression validation. (CVE-2026-97229)

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected GitLab server, potentially leading to complete system compromise and unauthorized access to sensitive data and resources.

We recommend the following actions be taken:

Copyright©2026 Center for Internet Security®