ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-97229

CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab

Published Oct 12, 2026 · GitLab GitLab

Check if you run it

No confirmed exploitation is on record for CVE-2026-97229. EPSS is 0.55%. Act only if a listed version of GitLab GitLab is installed.

Gaps on this record

  • No version range is stored. A customer cannot check an installed version against this record.
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Critical—
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.55%
Remediation
Not established
Affected products
GitLab GitLab

Overview On October 12, 2026, GitLab published a critical patch release for CVE-2026-97229 , an integer overflow or wraparound ( CWE-190 ) in the CI/CD regular expression compiler affecting GitLab Community Edition (CE) and Enterprise Edition (EE). GitLab assigned the vulnerability a CVSSv3.1 score of 10.0 . Under certain conditions, a remote attacker can execute arbitrary code on an affected GitLab server through a specially crafted regular expression stored in a malicious CI/CD configuration. While the vendor supplied CVSS score indicates that exploitation is fully unauthenticated, in reprod

No affected version ranges are stored yet. Use the vendor advisory before you decide this record does not apply.

How to fix CVE-2026-97229

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-97229. EPSS is 0.55%. Act only if a listed version of GitLab GitLab is installed.

Which versions are affected?

Affected version ranges are not on this record. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 0.55%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 13, 2026 · Rapid7 Vulnerability Database

    Detected

    Overview On October 12, 2026, GitLab published a critical patch release for CVE-2026-97229 , an integer overflow or wraparound ( CWE-190 ) in the CI/CD regular expression compiler affecting GitLab Community Edition (CE) and Enterprise Edition (EE). GitLab assigned the vulnerability a CVSSv3.1 score of 10.0 . Under certain conditions, a remote attacker can execute arbitrary code on an affected GitL

Sources

  • CVE.orgVulnerability recordCVE-2026-97229

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-97229

    30-day exploitation probability 0.5%

    first.org
  • GitLab Security ReleasesVendor advisoryCVE-2026-97229

    On October 12, 2026, we released versions 19.4.2, 19.3.5, 19.2.8 for GitLab Community Edition (CE) and Enterprise Edition (EE). 19.3.4 had a bug that affected merge request pages when the Ona integration was enabled. This is fixed in 19.3.5. These versions contain important bug a

    docs.gitlab.com
  • NCSC NetherlandsGovernment advisoryCVE-2026-97229

    GitLab heeft kwetsbaarheden verholpen in GitLab Community Edition (CE) en Enterprise Edition (EE), specifiek in versies voorafgaand aan 19.2.8, 19.3.5 en 19.4.2. De kwetsbaarheden zijn aanwezig in verschillende onderdelen van GitLab, waaronder de CI/CD pipelineomgeving, autorisat

    advisories.ncsc.nl
  • Rapid7 Vulnerability DatabaseResearchCVE-2026-97229

    Overview On October 12, 2026, GitLab released 19.4.2 , 19.3.5 , and 19.2.8 to fix CVE-2026-97229 , an integer overflow in its CI/CD regular-expression handling. The issue was reported through HackerOne by joaxcar . GitLab assigned it a CVSS score of 10.0 and described possible code execution by an unauthenticated user. The advisory states that CVE-2026-97229 affects GitLab CE and EE from 19.2 befo

    rapid7.com
  • Tenable CVE DatabaseVulnerability recordCVE-2026-97229

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

    tenable.com

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.