Critical GitLab flaw CVE-2026-97229 allows code execution and is now on CISA's exploited list
CRITICAL · VULNERABILITYCVE-2026-97229redteam/daily · 4 sources
- Severity
- Critical
- Highest CVSS
- 10.0
- Exploited
- Yes
- Sources
- 4
What happened
GitLab has fixed CVE-2026-97229, an integer overflow in its CI/CD regular-expression handling that carries a CVSS score of 10.0. A Rapid7 proof of concept showed that an attacker who can commit a malicious CI configuration and a crafted path to a public project can run OS commands as the git user on self-managed instances. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 29 October 2026, so self-managed administrators should upgrade without waiting for the normal patch cycle.
For IT people · Written by AI from 4 sources · Wrong?
What to do
- Upgrade self-managed GitLab CE or EE to 19.2.8, 19.3.5 or 19.4.2, depending on the release branch in use, without waiting for the normal patch cycle.
- If an upgrade cannot happen immediately, restrict anonymous access to public projects and prevent untrusted users from creating or writing to public projects.
- Check whether any self-managed GitLab instance runs a version before the fixed releases, including instances where new users can self-register.
- GitLab.com is already patched and GitLab Dedicated customers need take no action.
Written by AI from the sources, checked against them
Vulnerabilities
- CVE-2026-97229CVSS 10.0ExploitedGitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expressi
- CVE-2026-97631CVSS 9.5EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrit
Full story timeline · 8 updates
- Tue 13 OctoberCVE-2026-97229 published, CVSS 10.0NVD
- CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLabRapid7 Blog
- Fri 16 OctoberRapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)Rapid7 Blog
- Thu 22 OctoberCVE-2026-97631 published, CVSS 9.5NVD
- Tue 27 OctoberCode-execution flaw in UEFI firmware affects most servers on planet EarthArs Technica (Security)
- Wed 28 OctoberCVE-2026-97631: 16-Year-Old UEFI Flaw Threatens ServersSecurity Affairs
- Most Servers on the Planet Are Vulnerable to This Firmware Code-Execution FlawWired (Security)
- Thu 29 OctoberCVE-2026-97229 added to CISA’s exploited listCISA KEV
Who reported · 4 outlets
Rapid7 BlogArs Technica (Security)Security AffairsWired (Security)
Who and what is in it
Products