Critical GitLab Flaw Enables Remote Code Execution; Rapid7 Urges Urgent Patching
Summary
Rapid7 reproduced unauthenticated remote code execution via CVE-2026-97229 in self-managed GitLab CE/EE. Fixed versions are available; no in-the-wild exploitation is confirmed.
Key points
- The integer overflow affects GitLab’s CI/CD regular expression compiler and carries a CVSS 10.0 score.
- Exploitation requires a crafted CI/CD configuration and a specially formed UTF-8 repository path; creating a public project may satisfy the prerequisite where allowed.
- Rapid7 validated code execution on GitLab 19.4.1 CE and confirmed the same input did not execute on patched 19.4.2 CE.
- Affected self-managed versions should be upgraded to 19.2.8, 19.3.5, or 19.4.2, as applicable.
- GitLab.com is patched; GitLab Dedicated customers do not need to take action.
- Restricting anonymous access and untrusted users’ ability to create or write to public projects can reduce exposure until upgrading, but does not fix the vulnerability.
- No confirmed in-the-wild exploitation was reported.
Article Details
- Vulnerability Types
- Integer overflow or wraparound in the CI/CD regular expression compiler
- Severity
- Critical; CVSSv3.1 score 10.0
- Affected Versions
- GitLab CE/EE: all versions from 19.2 before 19.2.8
- GitLab CE/EE: all versions from 19.3 before 19.3.5
- GitLab CE/EE: all versions from 19.4 before 19.4.2
- Exploitation Status
- not_reported
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Restrict anonymous access to public projects.
- Prevent untrusted users from creating or writing to public projects.
MITRE ATT&CK
CVE
Vendors
GitLabOn October 12, 2026, GitLab published a critical patch release for CVE-2026-97229, an integer overflow or wraparound (CWE-190) in the CI/CD regular expression compiler affecting GitLab Community Edition (CE) andRapid7As of this writing, there is no confirmed in-the-wild exploitation of CVE-2026-97229. However, Rapid7 Intelligence has independently reproduced arbitrary code execution on an unpatched, official GitLab CE image. Given