GitLab fixed CVE-2026-97229 in Community Edition and Enterprise Edition on October 12, and Rapid7 independently reproduced arbitrary code execution on an unpatched GitLab CE image. The bug affects versions before 19.2.8, 19.3.5, and 19.4.2, and GitLab.com is already patched.
The flaw sits in the CI/CD regular expression compiler: a specially crafted pattern in a CI/CD config can overflow the compiler and produce code execution. Rapid7 found the practical gate is planting that config first, which means self-managed instances that let users self-register and create projects widen the exposure beyond classic repo access.
For organizations that run public self-managed GitLab, the trust boundary is the registration and project-creation path, not just repository ownership. After the patch, any instance that allowed untrusted users to plant CI/CD configs carries the lesson that a parser bug can become a server-wide issue wherever user-submitted config is interpreted on the backend.
Ra Gitlab Ci Cd Regex Integer Overflow Technical Analysis CVE-2026-97229
Rapid7 analyzes CVE-2026-97229, showing how GitLab CI regex compilation turns an Onigmo integer overflow into native code execution, with a public PoC.
GitLab patches a max-severity regex flaw alongside five high-severity bugs
The critical flaw could let unauthenticated attackers execute code on GitLab servers, while others involved pipeline security, repository access, and AI agent instruction injection.
CVE-2026-97229 Critical Unauthenticated Remote Code Execution in Gitlab
On October 12, 2026, GitLab published a critical patch release for CVE-2026-97229, an integer overflow or wraparound (CWE-190) in the CI/CD regular expression compiler affecting GitLab Community Edition (CE) and Enterprise Edition (EE).