CVE-2026-97229

Critical10.0 Published on Oct 13, 2026

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

CVSS score10.0 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness type (CWE)CWE-190

Vulnerabilities

GitLab Fixes CVSS 10.0 CI/CD Flaw Enabling Unauthenticated Server Code Execution

GitLab patched CVE-2026-97229, a CVSS 10.0 CI/CD flaw that could allow unauthenticated code execution via crafted regex, plus three high-severity fixes.

Oct 13, 202612:09 4 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

CVE-2026-97229

Related articles

GitLab Fixes CVSS 10.0 CI/CD Flaw Enabling Unauthenticated Server Code Execution

Audience measurement