CVE-2026-97229
Received Received - Intake

Arbitrary Code Execution in GitLab CE/EE via Malicious CI/CD Regex

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitLab Inc.

Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-97229
EUVD
EUVD-2026-98214

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
GitLab GitLab 19.2
GitLab GitLab 19.3
GitLab GitLab 19.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in GitLab allows an unauthenticated user to execute arbitrary code on the server by exploiting a flaw in regular expression validation within CI/CD configurations. The issue affects versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

Detection Guidance

This vulnerability involves arbitrary code execution via crafted regular expressions in CI/CD configurations. Check GitLab server logs for suspicious CI/CD pipeline configurations using complex or unusual regular expressions. Inspect .gitlab-ci.yml files in repositories for regex patterns that may appear obfuscated or overly complex. Verify GitLab version to ensure it is updated to 19.2.8, 19.3.5, or 19.4.2 or later.

Impact Analysis

An attacker could gain full control of the GitLab server, leading to unauthorized access, data theft, or disruption of services. This could compromise sensitive information stored in repositories or affect the integrity of CI/CD pipelines.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA compliance. Organizations may face legal penalties, reputational damage, and loss of trust due to data breaches.

Mitigation Strategies

Upgrade GitLab to version 19.2.8, 19.3.5, or 19.4.2 or later to address the arbitrary code execution vulnerability. Review CI/CD configurations for suspicious regular expressions and restrict unauthenticated access where possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97229. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart