GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
CVE-2026-97229
CVSS base score
10.0 (v3.1)
Severity
CRITICAL
Attack vector
Network
Weakness
CWE-190
Last modified
October 31, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
gitlab gitlab
References
- docs.gitlab.com Release Notes, Vendor Advisory
- gitlab.com Broken Link
- hackerone.com Permissions Required
- hackerone.com Permissions Required
- github.com
- www.ruby-lang.org
- www.cisa.gov US Government Resource