Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-97229: GitLab allows remote code execution via crafted CI/CD regex
CVE-2026-97229 · published today
Summary
All supported versions of GitLab Community and Enterprise Edition can be tricked by a specially crafted regular expression in a CI/CD configuration. An attacker without any login could cause the server to run code of their choice. Update GitLab to the latest release that includes the fix or apply the provided patches as soon as possible.
What to do
- Update gitlab gitlab to version 19.2.8 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| gitlab | gitlab | < 19.2.8 |
Original advisory text
Integer Overflow or Wraparound in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-190Integer Overflow
Timeline
Published13 Oct 2026
Updated13 Oct 2026
First seen13 Oct 2026
Track software like this
Free during beta