CVE-2026-97229
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
Added: 2026-10-29 · Due: 2026-11-01
Known ransomware use: Unknown
As of 2026-10-29
EPSS estimates exploitation probability over the next 30 days. KEV due dates apply to US federal civilian agencies. Confirm your affected versions in vendor advisories.
CWE: CWE-190 · Published: 2026-10-13T02:17:00.840 · Modified: 2026-10-29T20:17:37.330
Sources: NIST NVD, CISA KEV, FIRST EPSS. NVD and EPSS cached up to 6 hours; KEV up to 12 hours.