GitLab CE/EE: Remote code execution via CI/CD regular expression

Summary

Self-managed GitLab CE/EE instances contain an integer overflow in the CI/CD regular expression compiler (CWE-190), tracked as CVE-2026-97229 with a CVSS score of 10.0. Under certain conditions, an unauthenticated attacker can submit a specially crafted regular expression in a CI/CD configuration and execute arbitrary code on the GitLab server. CISA has added the flaw to its Known Exploited Vulnerabilities catalog, and GitLab.com and GitLab Dedicated were already patched by the vendor.

Affected

• GitLab CE/EE 19.2 before 19.2.8
• GitLab CE/EE 19.3 before 19.3.5
• GitLab CE/EE 19.4 before 19.4.2

Fixed in

• GitLab CE/EE 19.2.8
• GitLab CE/EE 19.3.5 (not 19.3.4, which has a merge request page bug with the Ona integration)
• GitLab CE/EE 19.4.2

Use the newest patch release on your branch. Later releases are reported only by secondary sources and must be verified on docs.gitlab.com.

Workaround

No workaround documented by the vendor. Interim measures suggested by a third party: restrict network access to the GitLab web interface to trusted networks or a VPN, and disable public project creation and anonymous access to CI/CD endpoints where feasible. These measures are not verified by the vendor.

Exploitation

• Actively exploited: CISA added CVE-2026-97229 to the KEV catalog on 29 October 2026, with a remediation deadline of 1 November 2026.
• An attempted attack reportedly targeted Alpine Linux's GitLab instance with crafted CI configurations, causing repeated worker crashes.
• Rapid7 reportedly reproduced code execution on an unpatched GitLab CE image 19.4.1, while the patched 19.4.2 image did not respond to the same input.
• No authentication is required. The Alpine case reportedly involved a newly registered account.

Our recommendation

• Inventory all self-managed GitLab instances and their versions.
• Upgrade to the newest patch on your branch, at least 19.2.8, 19.3.5 or 19.4.2, and verify against the vendor advisory before closing the ticket.
• Check whether the Ruby bundled with your GitLab installation is patched, because CISA notes that other products may be affected by the underlying Onigmo issue.
• If an instance is exposed, restrict access and review logs for unusual CI configuration submissions and crashing worker processes.
• If compromise is suspected, rotate CI/CD variables and runner tokens.
• Do not confuse this with CVE-2026-110264, a separate GitLab regular expression vulnerability that this update does not fix.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (6 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  AmpedWasTaken/CVE-2026-97229-GitLab-CI-CD-Regex-Compiler-RCE · jburgess-r7/CVE-2026-97229-PoC · gandli/cve-2026-97229-lab · Noshadi-sec/CVE-2026-97229 · murat-levi/gitlab-rce-toolkit
• Metasploit module exploit/multi/http/gitlab_cicd_regexp_rce_cve_2026_97229 – GitLab CI/CD RegExp Integer Overflow Remote Code Execution

Research sources

• GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8 docs.gitlab.com
• CISA Known Exploited Vulnerabilities Catalog: CVE-2026-97229 www.cisa.gov
• GitLab work item 630686 gitlab.com
• Help Net Security: GitLab CI/CD regular expression compiler vulnerability www.helpnetsecurity.com
• The Hacker News: Attacker tried to exploit Alpine Linux's GitLab thehackernews.com
• PBX Science: CISA adds GitLab CVSS 10.0 flaw to exploited list pbxscience.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:21.