CVE-2026-97229

critical · 10

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

CVSS

18.4%

EPSS (exploit prob.)

97th

EPSS percentile

2026-10-13

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-190

Affected products

Vendor	Product	Affected versions
gitlab	gitlab	>= 19.2.0, < 19.2.8
gitlab	gitlab	>= 19.2.0, < 19.2.8
gitlab	gitlab	>= 19.3.0, < 19.3.5
gitlab	gitlab	>= 19.3.0, < 19.3.5
gitlab	gitlab	>= 19.4.0, < 19.4.2
gitlab	gitlab	>= 19.4.0, < 19.4.2

Check a specific version with /api/v1/cve/match.

References

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
https://gitlab.com/gitlab-org/gitlab/-/work_items/630686
https://hackerone.com/reports/4055749
https://hackerone.com/reports/4058589

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-97229