GitLabCVE-2026-97229

GitLab: remote code execution

CVE-2026-97229 · Published Oct 13, 2026 · updated Nov 2, 2026

Critical10.0

Fix: upgrade to 19.2.8 or later (3 fixed versions below)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

Affected versions

Package	Affected	Fixed in
GitLab Product	>= 19.2, < 19.2.8	19.2.8
	>= 19.3, < 19.3.5	19.3.5
	>= 19.4, < 19.4.2	19.4.2

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-190

More GitLab advisories

All GitLab

Low 3.1Oct 22

GitLab: authenticated user could permanently delete existingCVE-2026-112326fixed in 19.3.6 +2 High 7.5Oct 22

GitLab: request smugglingCVE-2026-112212fixed in 19.3.6 +2 Critical 10.0Oct 22

GitLab: remote code executionCVE-2026-110264fixed in 18.11.13 +3 Medium 4.3Oct 22

GitLab: information disclosureCVE-2026-105777fixed in 19.3.6 +2 Low 3.5Oct 22

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0...CVE-2026-105711fixed in 19.3.6 +2 Low 2.7Oct 22

GitLab: improper authorizationCVE-2026-103515fixed in 19.3.6 +2