CVE-2026-97229

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

CVSS

10.0

EPSS

—

CISA KEV

Not listed

Exploitation

No report

Public exploits

None seen

State

PUBLISHED

Coverage

• Help Net Security◇Specialist. Specialist publisher: established trade press, or expert analysis with a track record2 hours ago

  GitLab admins urged to patch critical RCE flaw (CVE-2026-97229)

  GitLab is urging users of self-managed instances to patch a critical vulnerability (CVE-2026-97229) in its CI/CD Regular Expression Compiler that could allow remote attackers to execute arbitrary code on GitLab servers. About CVE-2026-97229 CVE-2026-97229 is an integer overflow vulnerability in…

  ↗helpnetsecurity.com/2026/10/13/gitlab-ci-cd-reg…(opens the publisher's site in a new tab)

What we observed