Vulnerabilities · 1 day ago
GitLab fixed CVE-2026-97229 in Community Edition and Enterprise Edition on October 12, and Rapid7 independently reproduced arbitrary code execution on an unpatched GitLab CE image. The bug affects versions before 19.2.8, 19.3.5, and 19.4.2, and GitLab.com is already patched.
The flaw sits in the CI/CD regular expression compiler: a specially crafted pattern in a CI/CD config can overflow the compiler and produce code execution. Rapid7 found the practical gate is planting that config first, which means self-managed instances that let users self-register and create projects widen the exposure beyond classic repo access.
For organizations that run public self-managed GitLab, the trust boundary is the registration and project-creation path, not just repository ownership. After the patch, any instance that allowed untrusted users to plant CI/CD configs carries the lesson that a parser bug can become a server-wide issue wherever user-submitted config is interpreted on the backend.
11 sources covering this story
Ra Gitlab Ci Cd Regex Integer Overflow Technical Analysis CVE-2026-97229
Rapid7 analyzes CVE-2026-97229, showing how GitLab CI regex compilation turns an Onigmo integer overflow into native code execution, with a public PoC.
GitLab patches a max-severity regex flaw alongside five high-severity bugs
The critical flaw could let unauthenticated attackers execute code on GitLab servers, while others involved pipeline security, repository access, and AI agent instruction injection.
CVE-2026-97229 Critical Unauthenticated Remote Code Execution in Gitlab
On October 12, 2026, GitLab published a critical patch release for CVE-2026-97229, an integer overflow or wraparound (CWE-190) in the CI/CD regular expression compiler affecting GitLab Community Edition (CE) and Enterprise Edition (EE).
GitLab rättar kritisk sårbarhet - CERT-SE
GitLab har publicerat säkerhetsuppdateringar för flera sårbarheter i GitLab Community Edition (CE) och Enterprise Edition (EE).
Kwetsbaarheden verholpen in GitLab
GitLab heeft kwetsbaarheden verholpen in GitLab Community Edition (CE) en Enterprise Edition (EE), specifiek in versies voorafgaand aan 19.2.8, 19.3.5 en 19.4.2.
GitLab admins urged to patch critical RCE flaw (CVE-2026-97229) - Help Net Security
GitLab is urging users of self-managed instances to patch a critical vulnerability (CVE-2026-97229) in its CI/CD Regular Expression Compiler.
GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code
GitLab fixed CVE-2026-97229 (CVSS 10.0), a CI/CD flaw that could allow unauthenticated code execution under certain conditions.
Múltiples vulnerabilidades en productos de GitLab
Distintos investigadores y miembros del equipo interno de GitLab han informado sobre 24 vulnerabilidad
GitLab fixes critical vulnerability that exposed software environments to sabotage
The company urged customers to upgrade to the latest versions of its flagship products.
GitLab warns of max severity code execution vulnerability
GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances.
Risolte vulnerabilità su GitLab CE/EE
Tra queste si evidenzia la CVE-2026-97229 per la quale risulta disponibile un Proof of Concept (PoC) in rete.
Part of the PlainSec briefing for 2026-10-17