CVE-2026-97229: GitLab CE/EE Integer Overflow (CWE-190) Enabling Code Execution via CI/CD Regex
GitLab has fixed CVE-2026-97229 in CE and EE for versions from 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. According to the record, under certain conditions an unauthenticated user could execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration. NVD and the CNA assign a CVSS 3.1 base score of 10.0 (critical), and the CVE is not listed in CISA KEV.
Overview
GitLab has remediated an issue in GitLab CE and EE affecting versions from 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. The description attributes the issue to insufficient regular expression validation in CI/CD configuration, while the record classifies it as CWE-190 (Integer Overflow or Wraparound).
Impact
According to the record, under certain conditions an unauthenticated user could execute arbitrary code on the GitLab server. The CVSS 3.1 base score is 10.0 (critical), with network attack vector, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
Affected products and versions
- GitLab CE/EE, versions 19.2 before 19.2.8
- GitLab CE/EE, versions 19.3 before 19.3.5
- GitLab CE/EE, versions 19.4 before 19.4.2
Exploitation status
The CVE is not listed in CISA KEV, so no active exploitation is confirmed by that catalog. No confirmed exploitation in the wild appears in the sources consulted. Two referenced HackerOne reports carry tags for technical description and exploit; their content is not reproduced here.
Remediation and mitigation
- Upgrade to GitLab 19.2.8 or later, 19.3.5 or later, or 19.4.2 or later, depending on the installed branch, as described in the GitLab patch release notes.
- Inventory GitLab instances and confirm their versions against the affected ranges.
- Until patched, limit who can change CI/CD configuration, since the description ties the issue to that context.
Detection guidance
- Review recent changes to CI/CD configuration files for unexpected or unusual content.
- Check GitLab server logs for unusual pipeline processing errors or unexpected activity.
- Verify the running version through the administrative interface after upgrading.
Limitations of the available information
The record's fixes list is empty, so the fixed builds shown here come from the upper bounds of the affected ranges. The source status is Undergoing Analysis. The CWE classification (CWE-190) does not match the regex validation described in the text, and the record does not resolve this. EPSS is 0.00559 (percentile 0.45008) as of 2026-10-13.
Frequently asked questions
Which GitLab versions are affected by CVE-2026-97229?
The record lists GitLab CE and EE versions from 19.2 before 19.2.8, from 19.3 before 19.3.5, and from 19.4 before 19.4.2.
Is CVE-2026-97229 being actively exploited?
It is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.