GitLab Says a Rigged Regex Can Hijack Its Servers With No Login, but Rapid7's Exploit Needed a Public Project

GitLab has shipped a fix for a perfect 10 severity bug and told every self-managed customer to upgrade immediately. The flaw, CVE-2026-97229, can let an attacker run commands on a GitLab server as the git user by feeding it a booby-trapped regular expression in a CI/CD config file.

GitLab's advisory says this can happen without logging in. Rapid7 rebuilt the exploit and found a catch: the attacker first needs a way to get a malicious pipeline file into a repository. On servers that let anyone sign up and create projects, that catch disappears.

What GitLab fixed

The bug is an integer overflow in GitLab's CI/CD Regular Expression Compiler, which parses, compiles and evaluates regexes in pipeline config files. It affects Community and Enterprise Edition from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. The patch release came out October 12.

GitLab says the issue "could have allowed an unauthenticated user to execute arbitrary code on the GitLab server" by planting a crafted regex in a CI/CD configuration, and that it "strongly recommend[s] that all self-managed GitLab installations be upgraded to one of these versions immediately." GitLab.com is already patched, and GitLab Dedicated customers need do nothing.

Researcher Johan Carlsson, known as joaxcar, reported it through GitLab's HackerOne bug bounty.

Rapid7's reproduction

Rapid7 reproduced code execution on an unpatched official GitLab CE 19.4.1 image with ASLR enabled. The same input did nothing on 19.4.2.

Its researchers noted that while the score implies fully unauthenticated exploitation, "an attacker must have a mechanism to plant a malicious CI/CD configuration to a repository prior to triggering the vulnerability." In practice, that means committing a malicious .gitlab-ci.yml and a repository path containing UTF-8 characters to a branch in a public project. "On GitLab instances where new users can self register and create projects, this constraint is removed," Rapid7 wrote.

So the "no login" label is a little generous, but not by much on servers with open registration. Any ordinary account can create the public project it needs.

How a regex becomes a shell

The trick plays on timing. The crafted regex first compiles in a compact US-ASCII form, and in that form it passes GitLab's validation checks.

Then it gets evaluated against a specially formed, valid UTF-8 repository path. Ruby's Onigmo regex engine recompiles the expression for the new encoding, after the checks are already done. An integer overflow in the compiler's program-size math then produces invalid instructions, breaking control-flow integrity and letting the attacker run an operating system command as the git user.

Another critical GitLab month

The same release fixed several high-severity bugs, including a stored XSS triggered by a crafted repository (CVE-2026-92883, 8.7), a hole that let Developer-role users run pipelines on protected branches through downstream pipelines (CVE-2026-16301, 8.5), and a cache poisoning bug in raw repository files that could expose protected environment variables (CVE-2026-14814, 8.2).

The timing is uncomfortable. Last month GitLab fixed another CVSS 10 flaw, CVE-2026-85706, which let unauthenticated attackers read credentials and other secrets. Attackers were probing for it within hours, and CISA added it to its exploited catalog a day later with a three-day federal deadline. Weeks ago GitLab also patched a 9.9 flaw that let logged-in Duo users escape a prompt sandbox in its AI Gateway. CISA has flagged five GitLab flaws abused in attacks since November 2021, one of them used by ransomware gangs.

GitLab says it has more than 30 million registered users and that over half the Fortune 100 use it, which makes self-managed instances a rich target.

What admins should do

As of Rapid7's writing, there was no confirmed exploitation in the wild. Rapid7 still recommends upgrading self-managed instances urgently and outside normal patch cycles.

Until the upgrade lands, restricting anonymous access to public projects and blocking untrusted users from creating or writing to public projects cuts off the path Rapid7 demonstrated. It does not fix the compiler bug underneath.

Some offers on this page may be paid placements or contain affiliate links.