CVE-2026-97229
CRITICAL · 10.0 KEV EPSS 26.6%Working PoC public, vendor patching urgently, but KEV not yet listed; likely exploitation soon.
What: GitLab CE/EE unauthenticated remote code execution via malicious CI/CD regex (versions 19.2–19.4), CVSS 10.0 critical.
Why it matters: Public PoC published by Rapid7 demonstrating weaponization (regex → buffer overflow → system() as git user); GitLab issued urgent patches same-day; affects all unpatched instances running vulnerable versions. No KEV listing yet, but immediate vendor patching and researcher PoC signal active risk.
Where it's seen: Rapid7 blog and GitHub PoC, GitLab security advisories, packet storm, infosec social chatter flagging patch urgency. Requires public project write access but unauthenticated entry via regex parsing.
RISK: CRITICAL — CVSS 10.0, public PoC, same-day patches, no authentication needed for regex submission.
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High