CVE-2026-97229
GitLab CI/CD regex compiler unauthenticated code execution
GitLab scores CVE-2026-97229 CVSS 3.1 10.0 in CE/EE: an integer overflow in the CI/CD regular expression compiler can, under certain conditions, let an unauthenticated user run arbitrary code via a crafted CI regex. Fixed in 19.2.8, 19.3.5, and 19.4.2 on 12 October 2026. GitLab.com and Dedicated already patched. Not in CISA KEV.
- CVSS
- 10
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Class
- RCE
- Status
- PoC Available
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- GitLab
- Products
- GitLab CE, GitLab EE
- Affected
- GitLab CE/EE from 19.2 before 19.2.8, from 19.3 before 19.3.5, and from 19.4 before 19.4.2. GitLab describes unauthenticated impact under certain conditions via a crafted regular expression in CI/CD configuration.
- Fixed
- 19.2.8, 19.3.5, and 19.4.2, released 12 October 2026.
- CWE
- CWE-190
- Published
- 12 Oct 2026
- Updated
- 14 Oct 2026
The status above is the claim. Links do not upgrade it.
CVE-2026-97229 is an integer overflow in GitLab’s CI/CD regular expression compiler. GitLab’s critical patch release on 12 October 2026 says that, under certain conditions, an unauthenticated user could execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
GitLab scores it CVSS 3.1 10.0 (Critical) with CWE-190. NVD lists that GitLab Secondary metric and marks the record Undergoing Analysis. Both Community Edition (CE) and Enterprise Edition (EE) are affected on the stated trains.
Fixed versions are 19.2.8, 19.3.5, and 19.4.2. GitLab says GitLab.com already runs the patched version and that GitLab Dedicated customers do not need to take action. Self-managed installations should upgrade immediately. Credit goes to joaxcar via GitLab’s HackerOne bug bounty program.
The same patch release also fixed many other issues. High-severity examples called out in press coverage include CVE-2026-92883 (XSS, CVSS 8.7), CVE-2026-16301 (improper authorization, CVSS 8.5), and CVE-2026-14814 (permissive regular expression, CVSS 8.2). This record covers only CVE-2026-97229.
The CVE is not in the CISA KEV catalog (catalog 2026.10.13). BleepingComputer and The Hacker News covered the disclosure; neither established active exploitation of this CVE ID.
A third-party GitHub repository published by Jonah Burgess (jburgess-r7, affiliated with Rapid7, not the credited HackerOne reporter) claims a lab PoC for CVE-2026-97229 against GitLab CE 19.4.1. ThreatWire has not run or verified it. Treat third-party PoC repos with caution and only test in isolated labs. The PoC link field on this record points to that repository; the URL is not repeated in the body.