GitLab said Monday that it had fixed a vulnerability that could have allowed an attacker to execute remote code on an affected server.

The critical-severity flaw, tracked as CVE-2026-97229, resulted from GitLab Community Edition and Enterprise Edition servers’ failure to check user input for malicious text, the software engineering and orchestration platform said in a patch release document.

The company issued new versions of both editions of its server that fix the problem and urged customers to upgrade. “These versions contain important bug and security fixes,” GitLab wrote, “and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately.”

Cloud-hosted instances are safe, Gitlab said, because the company has upgraded its own servers.

GitLab’s integral role in software development makes it a popular target for hackers seeking to steal sensitive information or compromise applications before they are released. The company lists NVIDIA, Goldman Sachs, Southwest Airlines, T-Mobile, Lockheed Martin and Siemens among its customers. GitLab issued an emergency patch in August for a flaw that could have let hackers tamper with projects, and the Cybersecurity and Infrastructure Security Agency (CISA) warned in September that hackers were exploiting another flaw that could have let attackers access files without authorization.

Hackers have used at least five GitLab vulnerabilities in attacks since 2021, according to a CISA catalog.

It remains unclear if attackers have begun exploiting the new vulnerability. As of Monday morning, CISA had not yet added the flaw to its catalog.