{"id":"CVE-2026-97229","kind":"vulnerability","aliases":["CVE-2026-97229"],"related":[],"title":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5,…","description":"GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"GitLab Community and Enterprise Edition have an integer overflow in regular expression handling for CI/CD configuration. An unauthenticated attacker who submits a specially crafted regular expression can execute arbitrary code on the GitLab server, and CISA lists the flaw as exploited in the wild.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2026-10-29T00:00:00+00:00","products":[{"name":"GitLab Community Edition and Enterprise Edition","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"gitlab","fixed":["19.2.8"],"affected":">= 19.2.0, < 19.2.8","ecosystem":"vendor"},{"name":"gitlab","fixed":["19.3.5"],"affected":">= 19.3.0, < 19.3.5","ecosystem":"vendor"},{"name":"gitlab","fixed":["19.4.2"],"affected":">= 19.4.0, < 19.4.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ci-cd","exploited","gitlab","self-hosted","vendor"],"not_affected_if":["managed-hosting"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-13T02:17:00+00:00","first_seen_at":"2026-10-29T20:25:01+00:00","triaged_at":"2026-10-29T20:25:57+00:00","updated_at":"2026-10-29T20:26:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-29T20:25:57Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"GitLab: crafted CI/CD regular expression lets an anonymous user run code","impact":"high","summary":"GitLab Community and Enterprise Edition have an integer overflow in regular expression handling for CI/CD configuration. An unauthenticated attacker who submits a specially crafted regular expression can execute arbitrary code on the GitLab server, and CISA lists the flaw as exploited in the wild.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["gitlab","self-hosted","ci-cd"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"code runs on the GitLab server without any login","analyst_note":"Find the GitLab advisory for CVE-2026-97229 to get affected and fixed versions and the patch release, and check the Alpine Linux and Rapid7 posts for exploitation details and indicators.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["managed-hosting"],"who_is_affected":"Self-managed GitLab Community Edition and Enterprise Edition servers are the exposed systems, because the flaw is reached through CI/CD configuration processing. Sources do not list affected or fixed versions, and do not say whether GitLab.com-hosted instances are affected. Teams running GitLab themselves should check their version against GitLab's advisory.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000724,"input_tokens":4559,"output_tokens":536,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the GitLab advisory for CVE-2026-97229 to get affected and fixed versions and the patch release, and check the Alpine Linux and Rapid7 posts for exploitation details and indicators.","search":"'-04':147C,173C,204C '-2026':20A,23A '-97229':21A,24A '19.2':13A '19.2.8':15A '19.3':16A '19.3.5':18A '26':146C,172C,203C 'accord':136C 'action':132C 'adher':200C 'affect':9A 'allow':102C 'and':28A 'appli':133C 'applic':170C 'arbitrari':71B,108C 'asset':194C 'attack':61B 'base':151C 'bod':145C,171C,202C 'cd':36B 'ce/ee':8A 'ci':35B 'ci-cd':34B 'ci/cd':57B,122C 'cisa':78B,130C,143C,160C 'cloud':176C 'code':72B,109C 'communiti':44B,88C 'community':26A 'complianc':141C 'configur':58B,123C 'contain':93C 'could':101C 'craft':66B,117C 'cve':19A,22A 'discontinu':179C 'due':124C 'edit':47B,89C,92C 'edition':27A,30A 'ensur':140C,199C 'enterpris':46B,91C 'enterprise':29A 'evalu':192C 'execut':70B,107C 'exploit':37B,83B 'exposur':197C 'express':54B,68B,119C,128C 'flaw':81B 'follow':169C 'forens':162C 'gitlab':1A,7A,25A,31A,32A,33A,38B,43B,75B,87C,112C 'guidanc':158C,174C 'guidelin':206C 'handl':55B 'host':41B 'instruct':139C 'insuffici':126C 'integ':50B,95C 'internet':196C 'issu':5A 'list':79B 'mitig':134C,185C 'note':157C,168C 'overflow':51B,96C 'patch':205C 'priorit':148C 'product':183C 'regular':53B,67B,118C,127C 'remedi':3A 'requir':131C,164C 'respons':190C 'risk':153C 'secur':149C 'see':154C,165C 'self':40B 'self-host':39B 'server':76B,113C 'servic':177C 'special':65B,116C 'stakehold':188C 'submit':63B 'triag':163C 'unauthent':60B,104C 'unavail':187C 'updat':150C 'url':155C,166C 'use':180C 'user':105C 'valid':129C 'vendor':42B,138C 'version':11A 'via':114C 'vulner':99C 'wild':86B 'wraparound':98C","nicknames":[],"mitigations":[],"who_affected":"Self-managed GitLab Community Edition and Enterprise Edition servers are the exposed systems, because the flaw is reached through CI/CD configuration processing. Sources do not list affected or fixed versions, and do not say whether GitLab.com-hosted instances are affected. Teams running GitLab themselves should check their version against GitLab's advisory.","tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-13T02:17:00+00:00","kev":{"dateAdded":"2026-10-29","dueDate":"2026-11-01","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-97229","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-97229","severity":null,"published_at":"2026-10-29T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-29T20:25:01+00:00","fetched_at":"2026-10-29T21:25:07+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-97229","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97229","severity":null,"published_at":"2026-10-13T02:17:00+00:00","modified_at":"2026-10-29T20:17:37+00:00","first_seen_at":"2026-10-29T20:26:51+00:00","fetched_at":"2026-10-29T20:26:51+00:00","note":null}],"documents":[{"id":4252,"url":"https://x.com/rapid7/status/2110064148625109005","title":"@rapid7: 🚨 On 10/12/26, #GitLab published a critical patch release for CVE-2026-97229 aff","kind":"post","source":"x","publisher":null,"text":"🚨 On 10/12/26, #GitLab published a critical patch release for CVE-2026-97229 affecting GitLab Community Edition (CE) &amp; Enterprise Edition (EE).\n\nToday, Rapid7 Intelligence has reproduced arbitrary code execution on an unpatched, official CE image. More: https://t.co/OrRby2FN36 https://t.co/F9WbNrmF0L\n\nlikes 21 reposts 10","published_at":"2026-10-13T17:44:30+00:00","relation":"discussion","confidence":null,"note":"@rapid7"},{"id":13067,"url":"https://news.ycombinator.com/item?id=50282544","title":"GitLab Security Incident: Attempted Exploitation of CVE-2026-97229","kind":"post","source":"hackernews","publisher":null,"text":"GitLab Security Incident: Attempted Exploitation of CVE-2026-97229\nhttps://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-28T23:45:46+00:00","relation":"discussion","confidence":null,"note":null},{"id":13072,"url":"https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html","title":"GitLab security incident: attempted exploitation of CVE-2026-97229 | Alpine Linux","kind":"advisory","source":"analyst","publisher":null,"text":"Alpine Linux: on Oct 20-21 2026 a newly registered account sent crafted CI configurations to gitlab.alpinelinux.org (GitLab 19.3.4, unpatched) to exploit CVE-2026-97229 (CVSS 10, Onigmo regex engine in Ruby, GitLab CI config regex evaluation). 8 worker crashes, 4 partial exploit progress; attacker downloaded Alpine's GitLab container image to tune the exploit; returned Oct 25-26. No evidence of code execution but cannot rule out; instance rebuilt, all passwords and secret keys reset. GitLab fixed releases Oct 12 (fix is patches to bundled Ruby, only in official omnibus packages/images). Upgrading to 19.3.6 with standard Ruby did NOT fix it. Ruby fix: 3.3.13, 3.4.12, 4.0.9 (Oct 23). alpinelinux/gitlab:19.3.6 image re-published Oct 27 with Ruby 3.3.13; earlier pulls and older tags vulnerable. Aports, packages and Oct 21 releases verified untampered; signing keys not on GitLab. Automated credential-stuffing logins seen too.","published_at":"2026-10-28T00:00:00+00:00","relation":"advisory","confidence":null,"note":null},{"id":18434,"url":"https://bsky.app/profile/campuscodi.risky.biz/post/3myzuaj7b3k2f","title":"@campuscodi.risky.biz: Alpine Linux says it was almost hacked using a recent GitLab bug\n\nalpinelinux.or","kind":"post","source":"bluesky","publisher":null,"text":"Alpine Linux says it was almost hacked using a recent GitLab bug\n\nalpinelinux.org/posts/GitLab...\nhttps://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html\n\nlikes 1 reposts 0","published_at":"2026-10-29T18:07:19+00:00","relation":"discussion","confidence":null,"note":"@campuscodi.risky.biz"},{"id":19114,"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/","title":"Vendor advisory: docs.gitlab.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: docs.gitlab.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}