GitLab CI regex compiler RCE is CVE-2026-97229

What happened

On 12 October 2026 GitLab published a critical patch release for 19.4.2, 19.3.5, and 19.2.8 (CE and EE). The lead fix is CVE-2026-97229, titled an integer overflow in the CI/CD regular expression compiler. GitLab says that, under certain conditions, an unauthenticated user could execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

GitLab scores the issue CVSS 3.1 10.0 (Critical) and maps it to CWE-190. NVD carries GitLab’s Secondary metric. Credit is to joaxcar through GitLab’s HackerOne bug bounty program. Related HackerOne report IDs appear in the CVE references.

The same release fixed a long table of other vulnerabilities. Among the high-severity items highlighted by The Hacker News are CVE-2026-92883 (XSS, CVSS 8.7), CVE-2026-16301 (improper authorization in downstream pipeline creation, CVSS 8.5), and CVE-2026-14814 (permissive regular expression in repository file access, CVSS 8.2). This article is only about CVE-2026-97229.

Who is affected

GitLab CE/EE versions from 19.2 before 19.2.8, from 19.3 before 19.3.5, and from 19.4 before 19.4.2 are in scope. Upgrade targets are 19.2.8, 19.3.5, and 19.4.2. GitLab notes that 19.3.4 had a separate merge-request page bug when the Ona integration was enabled; that bug is fixed in 19.3.5, so 19.3 operators should take 19.3.5 rather than stopping at 19.3.4.

GitLab.com is already patched. GitLab Dedicated customers were told they do not need to take action. Self-managed Omnibus, Docker, Helm, and source installs on the affected trains should upgrade. GitLab’s wording is “under certain conditions”; operators should not assume only fully private instances are out of scope.

What is confirmed

GitLab’s patch-release page, the CVE record, BleepingComputer (12 October 2026), and The Hacker News (13 October 2026) confirm the unauthenticated-under-certain-conditions code-execution impact, the integer-overflow / CI regex framing, the CE/EE editions, the fixed versions, the 12 October 2026 release date, HackerOne credit to joaxcar, and that GitLab.com / Dedicated were already covered.

The CVE is not in the CISA KEV catalog (catalog 2026.10.13). Neither BleepingComputer nor The Hacker News reported confirmed in-the-wild exploitation of CVE-2026-97229 at disclosure.

A third-party GitHub repository by Jonah Burgess (jburgess-r7, company Rapid7; not the credited HackerOne reporter joaxcar), created 13 October 2026, claims a lab PoC for CVE-2026-97229 validated against official GitLab CE 19.4.1. Its README describes a chain that uses project write access for setup and a later request without credentials for delivery. ThreatWire has not run or verified it. Treat third-party PoC repos with caution and only test in isolated labs. Another repository under AmpedWasTaken explicitly states it is investigation material, not a working RCE PoC; it is not used as the fiche PoC link.

What is not confirmed

Active exploitation of CVE-2026-97229 in the wild is not established by GitLab, CISA, BleepingComputer, or The Hacker News.

ThreatWire has not independently reproduced the third-party PoC. Exact reachability without any prior project relationship remains framed only by GitLab’s “under certain conditions” language and by third-party write-ups that ThreatWire did not verify.

What to do

Upgrade self-managed GitLab CE/EE to 19.4.2, 19.3.5, or 19.2.8 (or later on those lines) immediately. Prefer the patch release matching your current minor version. Confirm the running version after upgrade. GitLab.com and Dedicated follow GitLab’s guidance above.

If you build GitLab from source on your own Ruby runtime, confirm you also receive any bundled runtime fixes that Omnibus/Docker/Helm packages carry with the patch release.

Sources: GitLab critical patch release for 19.4.2 / 19.3.5 / 19.2.8, CVE.org / NVD for CVE-2026-97229, BleepingComputer, The Hacker News, CISA KEV catalog 2026.10.13 (not listed).