Zero Day MonitorZDM

← Back to list

10.0

CVE-2026-97229PATCHED

gitlab · gitlab

Integer Overflow or Wraparound in GitLab

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

Affected Products

Vendor	Product	Versions
gitlab	gitlab	19.2, 19.3, 19.4

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/630686
https://hackerone.com/reports/4055749(technical-description, exploit, permissions-required)
https://hackerone.com/reports/4058589(technical-description, exploit, permissions-required)
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/

Related News (10 articles)

Tier D

Help Net Security3h ago

Week in review: Hidden implant in Ledger wallets linked to $93M theft, 1,500+ npm packages exposed

→ No new info (linked only)

Tier C

Rapid7 Blog1d ago

Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)

→ No new info (linked only)

Tier E

Reddit r/cybersecurity4d ago

GitLab admins urged to patch critical RCE flaw (CVE-2026-97229) - Help Net Security

→ No new info (linked only)

Tier D

CSO Online4d ago

GitLab patches a max-severity regex flaw alongside five high-severity bugs

→ No new info (linked only)

Tier C

Rapid7 Blog4d ago

CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab

→ No new info (linked only)

Tier E

Hacker News5d ago

GitLab Released critical patch for CVSS 10.0 CVE

→ No new info (linked only)

Tier D

Help Net Security5d ago

GitLab admins urged to patch critical RCE flaw (CVE-2026-97229)

→ No new info (linked only)

Tier D

Heise Security5d ago

Sicherheitslücke mit maximalem Schweregrad bedroht GitLab

→ No new info (linked only)

Tier D

The Hacker News5d ago

GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code

→ No new info (linked only)

Tier C

VulDB5d ago

CVE-2026-97229 | GitLab up to 19.2.7/19.3.4/19.4.1 Regular Expression Validation incorrect regex

→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.110.0 CRITICAL

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA KEV❌ No

Actively exploited❌ No

Patch available

19.2.819.3.519.4.2

CWECWE-190

PublishedOct 13, 2026

Trending Score78

Source articles10

Independent8

Info Completeness0/14

Missing: cve_id, title, description, vendor, product, versions, cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

CRITICALCVE-2026-85706EXPKEV

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

HIGHCVE-2026-92883

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

CRITICALCVE-2026-90970

Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

HIGHCVE-2026-16301

Incorrect Authorization in GitLab

HIGHCVE-2026-14814

Permissive Regular Expression in GitLab

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Oct 13, 2026

Discovered by ZDM

Oct 13, 2026

Patch Available

Oct 14, 2026