Nvidia, GitLab and Goldman Sachs: GitLab warns of max severity code execution vulnerability

GitLab Patches Critical CI/CD Vulnerability Allowing Remote Code Execution

GitLab has issued an urgent security advisory urging users to patch a maximum-severity vulnerability (CVE-2026-97229) in its CI/CD Regular Expression Compiler. The flaw, discovered by security researcher joaxcar via GitLab’s HackerOne bug bounty program, could enable unauthenticated attackers to execute arbitrary code on vulnerable instances by exploiting an integer overflow weakness in the regular expression parser.

The vulnerability affects GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.2 prior to 19.2.8, 19.3 prior to 19.3.4, and 19.4 prior to 19.4.2. GitLab has released fixes in these versions, while GitLab.com and Dedicated customers are already protected. The company emphasized the urgency of upgrading self-managed instances.

This follows a recent trend of high-impact GitLab vulnerabilities, including:

• CVE-2026-0723 (January 2026): A high-severity 2FA bypass allowing attackers with a target’s account ID to circumvent authentication.
• CVE-2026-85706 (February 2026): A maximum-severity flaw enabling unauthenticated access to sensitive data, later added to CISA’s Known Exploited Vulnerabilities Catalog after active exploitation was confirmed.

Since November 2021, CISA has flagged five GitLab vulnerabilities exploited in attacks, including one leveraged by ransomware groups. With over 30 million users and adoption by major enterprises like Nvidia, T-Mobile, and Goldman Sachs, the platform remains a high-value target for threat actors.

Source: https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/

Nvidia TPRM report: https://www.rankiteo.com/company/nvidia

GitLab TPRM report: https://www.rankiteo.com/company/gitlab-com

Goldman Sachs TPRM report: https://www.rankiteo.com/company/goldman-sachs

"id": "gitgolnvi1791815573",
"linkid": "gitlab-com, goldman-sachs, nvidia",
"type": "Vulnerability",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': 'Major enterprises including '
                                              'Nvidia, T-Mobile, and Goldman '
                                              'Sachs',
                        'industry': 'Technology/DevOps',
                        'name': 'GitLab',
                        'size': '30 million users',
                        'type': 'Software Provider'}],
 'attack_vector': 'Unauthenticated exploitation of integer overflow in regular '
                  'expression parser',
 'customer_advisories': 'Urgent advisory to upgrade affected GitLab instances.',
 'description': 'GitLab has issued an urgent security advisory urging users to '
                'patch a maximum-severity vulnerability (CVE-2026-97229) in '
                'its CI/CD Regular Expression Compiler. The flaw could enable '
                'unauthenticated attackers to execute arbitrary code on '
                'vulnerable instances by exploiting an integer overflow '
                'weakness in the regular expression parser.',
 'impact': {'systems_affected': 'GitLab Community Edition (CE) and Enterprise '
                                'Edition (EE) versions 19.2 prior to 19.2.8, '
                                '19.3 prior to 19.3.4, and 19.4 prior to '
                                '19.4.2'},
 'post_incident_analysis': {'corrective_actions': 'Patches released to fix the '
                                                  'vulnerability in affected '
                                                  'versions.',
                            'root_causes': 'Integer overflow weakness in the '
                                           'regular expression parser of '
                                           "GitLab's CI/CD compiler."},
 'recommendations': 'Users should immediately upgrade to patched versions '
                    '(19.2.8, 19.3.4, or 19.4.2) to mitigate the risk of '
                    'remote code execution.',
 'references': [{'source': 'GitLab Security Advisory'},
                {'source': 'HackerOne Bug Bounty Report (Researcher: joaxcar)'},
                {'source': 'CISA Known Exploited Vulnerabilities Catalog'}],
 'response': {'communication_strategy': 'Urgent security advisory issued',
              'containment_measures': 'Patches released for affected versions '
                                      '(19.2.8, 19.3.4, 19.4.2)',
              'remediation_measures': 'Upgrading self-managed instances to '
                                      'patched versions'},
 'title': 'GitLab Patches Critical CI/CD Vulnerability Allowing Remote Code '
          'Execution',
 'type': 'Remote Code Execution (RCE)',
 'vulnerability_exploited': 'CVE-2026-97229'}