What happened
CISA has added a GitLab vulnerability, tracked as CVE-2026-97229, to its Known Exploited Vulnerabilities Catalog. The entry went up on 29 October 2026, with a remediation due date of 1 November 2026.
The flaw is an integer overflow in GitLab Community Edition and Enterprise Edition that stems from weak regular expression validation. CISA says a maliciously crafted regular expression in a CI/CD configuration can let an unauthenticated user run arbitrary code on the GitLab server.
CISA traces the problem to a Ruby/Onigmo integer overflow in the CI/CD regular expression compiler that could affect other products too. A fix is available in the GitLab 19.4.2 patch release.
Who is affected
Organizations running self-managed GitLab Community or Enterprise Edition.
What to do
- Apply GitLab's mitigations or the vendor's patch.
- If no mitigation is available, stop using the affected product.
Sources
Changelog
- First published.