Arbitrary Code Execution Vulnerability in GitLab CE/EE
CVE-2026-97229

10CRITICAL

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
13 October 2026

Badges

📰 News Worthy

What is CVE-2026-97229?

A vulnerability in GitLab's CI/CD configuration could permit an unauthenticated attacker to execute arbitrary code on the server. This exploit arises from insufficient validation of a specially crafted regular expression. Affected versions include GitLab CE/EE 19.2 prior to 19.2.8, 19.3 prior to 19.3.5, and 19.4 prior to 19.4.2. GitLab has released patches to mitigate this issue, underscoring the importance of updating to maintain system integrity and security.

Affected Version(s)

GitLab 19.2 < 19.2.8

GitLab 19.3 < 19.3.5

GitLab 19.4 < 19.4.2

News Articles

favicon imageBleepingComputer

GitLab warns of max severity code execution vulnerability

GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances.

14 hours ago

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/630686
https://hackerone.com/reports/4055749
technical-descriptionexploitpermissions-required
https://hackerone.com/reports/4058589
technical-descriptionexploitpermissions-required

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • 📰

    First article discovered by BleepingComputer

  • Vulnerability Reserved

Credit

Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program
.