---
title: GitLab critical patch: CVSS 10.0 unauthenticated RCE via CI/CD regex (CVE-2026-97229) | ctxsec
url: https://ctxsec.com/items/gitlab-cve-2026-97229
description: ""
status: "confirmed (vendor), public PoC, not on KEV"
published: 2026-10-12
---

> 

[← Cybersecurity News](/news) · [markdown](/items/gitlab-cve-2026-97229.md)

confirmed (vendor), public PoC, not on KEV

2026-10-12

### GitLab critical patch: CVSS 10.0 unauthenticated RCE via CI/CD regex (CVE-2026-97229)

GitLab's Oct 12 critical patch release (19.4.2, 19.3.5, 19.2.8) fixes CVE-2026-97229, an integer overflow in the CI/CD regular-expression compiler that could let an **unauthenticated** user run code on the server through a crafted regex in CI/CD configuration (CVSS 10.0). Affected: 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2. GitLab.com and Dedicated are already patched; self-managed must upgrade. **Rapid7** says it reproduced arbitrary code execution on an unpatched official CE image (Oct 13), and researcher CryptoCat published a Rapid7 PoC that reaches `system()` as GitLab's git user; that PoC requires write access to a public project. Censys counts 25,766 hosts running affected versions. No in-the-wild exploitation reported yet. The same release fixes CVE-2026-96893, a prompt-injection issue in GitLab Duo Agent Platform. Not on CISA KEV. Note: some posts cite 19.3.4; GitLab's fixed 19.3 build is 19.3.5. **Update Oct 16:** Rapid7 published a technical analysis with an end-to-end PoC that runs commands as GitLab's `git` OS user on the official 19.4.1 CE image with ASLR on. Its route needs the attacker to first push a malicious CI config and a specially named path to a public project, with only the final CI lint request unauthenticated, which Rapid7 notes conflicts with GitLab's no-privileges rating. Still no reported in-the-wild exploitation.

Sources: [GitLab critical patch release](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/) · [CVE-2026-97229](https://www.cve.org/CVERecord?id=CVE-2026-97229) · [@censysio (exposure)](https://x.com/censysio/status/2110126001380262023) · [@rapid7 (reproduction)](https://x.com/rapid7/status/2110064148625109005) · [@_CryptoCat (PoC)](https://x.com/_CryptoCat/status/2110052018593362428) · [Rapid7 technical analysis](https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229)