Unauthenticated RCE via crafted regular expression in GitLab CI/CD configuration (CVE-2026-97229)
CISA added this flaw to KEV on 2026-10-29 with a remediation deadline of 2026-11-01, Alpine Linux has disclosed an attempted exploitation against its own GitLab server, and four public exploits are in VulnCheck XDB, so an unpatched instance reachable by untrusted users is a server waiting to be taken over.
An integer overflow in GitLab's regular-expression handling lets an unauthenticated user execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration, because the regex is insufficiently validated. Successful exploitation gives the attacker control of the GitLab host and everything it stores: source, pipelines, secrets and tokens.
Affected: GitLab CE/EE 19.2.0 – 19.2.7 (fixed in 19.2.8); GitLab CE/EE 19.3.0 – 19.3.4 (fixed in 19.3.5); GitLab CE/EE 19.4.0 – 19.4.1 (fixed in 19.4.2)
How to Test
Check the running GitLab version (Admin Area or the /help page on the instance) against the fixed releases 19.2.8, 19.3.5 and 19.4.2; anything in 19.2, 19.3 or 19.4 below those is vulnerable. If the instance was exposed before patching, review recently pushed or modified CI/CD configuration files for unusual regular-expression content, inspect GitLab and Rails application logs around CI pipeline processing for crashes or anomalies, and look for unexpected processes, users, tokens or files on the GitLab server. Alpine Linux's incident write-up (alpinelinux.org, 2026-10-28) describes an attempted exploitation on their instance and is a useful reference for what to look for.
How to Patch
Upgrade GitLab to 19.2.8, 19.3.5 or 19.4.2 (or later) per GitLab's 19.4.2 patch release. The fix includes the regexp changes shipped by Ruby on 2026-10-23 for the GitLab CVEs; if you cannot upgrade immediately, restrict who can reach the instance and who can push CI/CD configuration until the patch is applied.