CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab
Rapid7 reproduced unauthenticated GitLab RCE CVE-2026-97229 (CVSS 10) and urges immediate patching.
On October 12, 2026, GitLab patched CVE-2026-97229, a CVSS 10.0 integer overflow (CWE-190) in the CI/CD regular-expression compiler affecting GitLab Community and Enterprise Edition. Rapid7 reproduced arbitrary code execution on the official GitLab 19.4.1 CE image by committing a malicious .gitlab-ci.yml and a UTF-8 repository path that makes Ruby's Onigmo engine recompile the expression and run an operating-system command as the git user. The same input did not execute on patched 19.4.2, and Rapid7 says there is no confirmed in-the-wild exploitation. Self-managed instances should upgrade to 19.2.8, 19.3.5, or 19.4.2 immediately; instances allowing self-registration are especially exposed.
- CVSS 10.0 integer overflow in GitLab's regex compiler
- Rapid7 achieved code execution on unpatched 19.4.1 CE
- Attack requires planting a malicious .gitlab-ci.yml
- No confirmed in-the-wild exploitation
- Fixed releases are 19.2.8, 19.3.5, and 19.4.2
Coverage
oldest first · one row per article · UTC- · 12d ago
Rapid7 BlogFirst report
CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab
Rapid7 reproduced unauthenticated GitLab RCE CVE-2026-97229 (CVSS 10) and urges immediate patching.
- · 12d ago
CSO Online
GitLab patches a max-severity regex flaw alongside five high-severity bugs
GitLab patched unauthenticated CI/CD regex RCE CVE-2026-97229 (CVSS 10) and five high-severity flaws.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-97229 | Unauthenticated RCE in GitLab CE/EE via CI/CD regex | 10.0 group max | <1% | PoC ×4 | |
| CVE-2026-90970 | Prompt sandbox escape to RCE in GitLab AI Gateway | 9.9 | 17% | PoC |