CVE-2026-97229
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could…
- Severity: Critical
- CVSS 10.0
- EPSS 18.43%
- Public exploit
- P1 · Patch now
Why P1: public exploit, high EPSS.
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
Affected products
- gitlab >= 19.2.0, < 19.2.8
- gitlab >= 19.2.0, < 19.2.8
- gitlab >= 19.3.0, < 19.3.5
- gitlab >= 19.3.0, < 19.3.5
- gitlab >= 19.4.0, < 19.4.2
- gitlab >= 19.4.0, < 19.4.2
Weakness
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- NVD record NVD
- CVE Program record CVE Program
- Reference NVD
- Reference NVD
- Reference NVD
- Reference NVD
- GitHub security advisory GitHub
- Advisory reference GitHub