CVE-2026-97229
GitLab: integer overflow can lead to remote code execution
- Risk score
- 74/100
- CVSS
- 10.0 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 13 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD confi…
- Affected
- GitLab before 19.2.8, 19.3, 19.3.5, 19.4, 19.4.2
- Fix
- Upgrade GitLab to 19.2.8, 19.3, 19.3.5, 19.4 or 19.4.2 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Story map
At a glance
GitLab: Amber, patch this week. GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD confi…
The flaws
- CVE-2026-97229: Integer overflow can lead to remote code execution (CVSS 10.0 · EPSS 1%)
- CVE-2026-93577: Integer overflow can lead to remote code execution (CVSS 9.9 · EPSS 1%)
- CVE-2026-89078: Double free can lead to remote code execution (CVSS 9.9 · EPSS 0%)
- CVE-2026-84739: Cross-site scripting (CVSS 8.7 · EPSS 0%)
The fix
Upgrade GitLab: 19.2.8 · 19.3 · 19.3.5 · 19.4 · 19.4.2 · 19.2.7 or later on your release line
Who is exposed: GitLab before 19.2.8, 19.3, 19.3.5, 19.4, 19.4.2
Where it stands
- No known exploitation
- 1 outlet covering it
How it unfolded
- 22 Oct, BleepingComputer (press): GitLab warns of new max severity code execution vulnerability
Connects to
- Same weakness: Integer overflow (CWE-190). 124 other warnings in 30 days
- Same product: Earlier GitLab warnings. 31 in the last 90 days
- Reported alongside: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability. CVE-2026-85706 · in 1 of the same article
In the news
TL;DR
GitLab has remediated a critical vulnerability (CVE-2026-97229) affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2, allowing unauthenticated users to execute arbitrary code via a specially crafted regular expression in a CI/CD configuration.
- GitLab has fixed the vulnerability in versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13.
- GitLab.com is already running the patched version.
- Shadowserver tracks over 2,700 GitLab Community Edition instances exposed online, but it's unclear how many are honeypots or secured against attacks.
- GitLab warned customers about another critical remote code execution vulnerability (CVE-2026-...) ten days ago.
AI summary of 1 article.
Why it is Amber
- CVSS 10.0 critical
- Remotely exploitable without logging in
References
Original description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
Last activity 13 Oct 2026. Patch Forecast updates every hour.