Reported by 13 outlets
GitLab CVE-2026-97229 Critical Unauthenticated Arbitrary Code Execution (CVSS 10.0)
Why this score
- Breadth
- 2.00 / 2.0 · 13 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 4.50 / 5.0 · CVSS + content signals
- Velocity
- 2.00 / 2.0 · updates in 48h
- Pickup speed
- 0.49 / 0.6 · time to second source
- Recency
- × 0.66 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 7.2 / 10 = base × recency + community
Desk analysis
GitLab has released emergency updates for CVE-2026-97229, a critical integer overflow in its CI/CD Regular Expression Compiler rated CVSS 10.0. An unauthenticated attacker can execute arbitrary code on the server with a specially crafted regular expression embedded in a project's pipeline configuration file, due to insufficient regex validation. The flaw affects both Community Edition and Enterprise Edition. Researcher joaxcar reported it through GitLab's HackerOne bounty program.
Fixed versions are 19.2.8, 19.3.4, and 19.4.2, and GitLab urges all self-managed installations to upgrade immediately. GitLab.com is already patched and Dedicated customers need no action. No in-the-wild exploitation has been reported so far, but unauthenticated RCE with maximum severity on internet-exposed DevOps infrastructure is the profile attackers scan for within days.
Self-hosted GitLab owners should patch now and review pipeline configs for suspicious regex additions. Watch for CISA KEV listing or reports of active scanning, which would confirm the expected exploitation interest.
Timeline
-
original reporting
A GitLab critical vulnerability, CVE-2026-97229 (CVSS 10.0), allows unauthenticated arbitrary code execution. Upgrade to GitLab 19.4.2 now.
securityonline.info · 1d ago · October 12th, 2026
A GitLab critical vulnerability, CVE-2026-97229 (CVSS 10.0), allows unauthenticated arbitrary code execution. Upgrade to GitLab 19.4.2 now.
via Mastodon https://securityonline.info/gitlab-cve-2026-97229-arbitrary-code-execution/?utm_source=mastodon&utm_medium=jetpack_social
-
update from bleepingcomputer.com
GitLab warns of max severity code execution vulnerability
bleepingcomputer.com · 1d ago · October 12th, 2026
GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances. Tracked as CVE-2026-97229 , this critical security flaw was discovered by a security researcher using the ' joaxcar ' handle and reported via GitLab's HackerOne bug bounty program. CVE-2026-97229 stems from an integer overflow weakness in GitLab's CI/CD Regular Expression Compiler, which parses, compiles, and evaluates regular expressions in projects' pipeline configuration files. "GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation," the company explained in a Monday advisory. GitLab fixed the security issue in GitLab Community Edition (CE) and Enterprise Edition (EE) versions from 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2, and urged users to patch their servers immediately. "These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately," it warned. "GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action." CVE-2026-97229 is the latest in a string of vulnerabilities that GitLab has addres
-
mentioned by docs.gitlab.com
GitLab security advisory. The standout CVE is a 10.0 critical CVE-2026-97229 - Integer Overflow issue in CI/CD Regular Expression Compiler i
docs.gitlab.com · 1d ago · October 12th, 2026
-
update from www.bleepingcomputer.com
🤖 CVE-2026-97229 (CVSS 10.0): unauthenticated RCE in GitLab's CI/CD regex compiler — integer overflow / insufficient regex validation, trigg
www.bleepingcomputer.com · 1d ago · October 12th, 2026
🤖 CVE-2026-97229 (CVSS 10.0): unauthenticated RCE in GitLab's CI/CD regex compiler — integer overflow / insufficient regex validation, trigg
via Mastodon https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/
-
update from www.bleepingcomputer.com
Reward: You've received a Gavel of Marginal Competence — equip it before the next vuln drops, counselor. https://www. bleepingcomputer.com/n
www.bleepingcomputer.com · 1d ago · October 12th, 2026
Reward: You've received a Gavel of Marginal Competence — equip it before the next vuln drops, counselor.
-
update from suriq.io
⚠️ PATCH NOW A crafted regex in a CI/CD config can run code on a self-managed GitLab server. No login required. GitLab CVE-2026-97229 is a C
suriq.io · 1d ago · October 13th, 2026
No login required. GitLab CVE-2026-97229 is a C
via Mastodon https://suriq.io/blog/gitlab-cve-2026-97229-cicd-regex-unauth-rce
-
mentioned by www.bleepingcomputer.com
🤖 CVE-2026-97229: unauthenticated RCE in GitLab's CI/CD Regular Expression Compiler. A crafted regex triggers an integer overflow, letting a
www.bleepingcomputer.com · 1d ago · October 13th, 2026
-
update from gbhackers.com
Critical GitLab Vulnerability Allows Unauthenticated Attackers to Execute Remote Code
gbhackers.com · 22h ago · October 13th, 2026
GitLab has released emergency security updates to address a critical vulnerability that could allow unauthenticated attackers to execute arbitrary code on affected servers. On October 12, 2026, the company released versions 19.4.2, […] The post Critical GitLab Vulnerability Allows Unauthenticated Attackers to Execute Remote Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from socprime.com
CVE-2026-97229: Critical GitLab RCE Flaw Enables Unauthenticated Code Execution
socprime.com · 19h ago · October 13th, 2026
Successful exploitation could compromise the confidentiality, integrity, and availability of a GitLab environment without requiring authentication or user interaction. With source-code management and CI/CD infrastructure containing sensitive repositories, credentials, deployment secrets, and access to production environments, vulnerabilities in GitLab can create significant risks for modern software supply chains. Security teams can strengthen their defenses against emerging vulnerability exploitation with SOC Prime’s AI-Native Detection Intelligence Platform, accelerating threat hunting and detection engineering while adapting detection logic to their organization’s security telemetry. Con
-
update from suriq.io
GitLab (CVSS 10, unauthenticated RCE) and Argo CD (four criticals) both shipped maximum-severity fixes for their build and deploy control pl
suriq.io · 18h ago · October 13th, 2026
GitLab (CVSS 10, unauthenticated RCE) and Argo CD (four criticals) both shipped maximum-severity fixes for their build and deploy control pl
via Mastodon https://suriq.io/blog/signal-pipeline-rce-blast-radius
-
mentioned by docs.gitlab.com
🤖 CVE-2026-97229 (CVSS 10.0): unauthenticated RCE on GitLab CE/EE servers via a crafted regular expression in a CI/CD config (insufficient r
docs.gitlab.com · 17h ago · October 13th, 2026
-
update from www.cert.se
(cert.se) GitLab Patches Critical Remote Code Execution Vulnerability in CI/CD Pipeline In brief - This article announces critical security
www.cert.se · 17h ago · October 13th, 2026
(cert.se) GitLab Patches Critical Remote Code Execution Vulnerability in CI/CD Pipeline In brief - This article announces critical security
via Mastodon https://www.cert.se/2026/10/gitlab-rattar-kritisk-sarbarhet.html
-
update from rapid7.com
CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab
rapid7.com · 16h ago · October 13th, 2026
GitLab assigned the vulnerability a CVSSv3.1 score of 10.0 . While the vendor supplied CVSS score indicates that exploitation is fully unauthenticated, in reproducing the exploit it was noted that an attacker must have a mechanism to plant a malicious CI/CD configuration to a repository prior to triggering the vulnerability. On GitLab instances where new users can self register and create projects, this constraint is removed. As of this writing, there is no confirmed in-the-wild exploitation of CVE-2026-97229. However, Rapid7 Intelligence has independently reproduced arbitrary code execution on an unpatched, official GitLab CE image. Given the vulnerability's maximum CVSS score, network-accessible trigger, and code execution in a GitLab application worker, Rapid7 recommends upgrading affected self-managed instances on an urgent basis, outside of normal pat
-
mentioned by www.rapid7.com
(rapid7.com) Critical Arbitrary Code Execution Vulnerability in GitLab CI/CD Regular Expression Compiler (CVE-2026-97229) In brief - This ar
www.rapid7.com · 16h ago · October 13th, 2026
-
update from beyondmachines.net
GitLab Issues Emergency Patch for Maximum-Severity Code Execution Vulnerability GitLab released emergency security updates to fix a maximum-
beyondmachines.net · 16h ago · October 13th, 2026
GitLab Issues Emergency Patch for Maximum-Severity Code Execution Vulnerability GitLab released emergency security updates to fix a maximum-
via Mastodon https://beyondmachines.net/event_details/gitlab-issues-emergency-patch-for-maximum-severity-code-execution-vulnerability-i-y-t-9-y/gD2P6Ple2L
-
update from malware.news
GitLab security advisory (AV26-1028)
malware.news · 14h ago · October 13th, 2026
Serial number: AV26-1028 Date: October 13, 2026 As of October 12, 2026, GitLab is affected by vulnerabilities in the following product: GitLab Prior to 19.2.8 Prior to 19.3.5 Prior to 19.4.2 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8 GitLab release notes | GitLab Docs Article Link: GitLab security advisory (AV26-1028) - Canadian Centre for Cyber Security
-
mentioned by docs.gitlab.com
On October 12, GitLab patched CVE-2026-97229, a CVSS 10 flaw. Under certain conditions, an unauthenticated attacker can use a crafted CI/CD
docs.gitlab.com · 13h ago · October 13th, 2026
-
mentioned by linuxmint.hu
Security news: Critical GitLab CI/CD remote code execution vulnerability fixed (CVE-2026-97229)
linuxmint.hu · 12h ago · October 13th, 2026
-
update from helpnetsecurity.com
GitLab admins urged to patch critical RCE flaw (CVE-2026-97229) - Help Net Security
helpnetsecurity.com · 9h ago · October 13th, 2026
GitLab's hosted service has already been patched. Status: CONFIRMED — Vendor security advisory and published tec
via reddit r/cybersecurity: GitLab admins urged to patch critical RCE flaw (CVE-2026-97229) - Help Net Security
-
mentioned by censys.com
🚨 Rapid Response: Critical GitLab CI/CD Remote Code Execution (CVE-2026-97229) A critical vulnerability (CVSS 10.0) in GitLab Community Edit
censys.com · 6h ago · October 13th, 2026