GitLab CI/CD regular expression compiler remote code execution (CVE-2026-97229)

GitLab says an unauthenticated user could execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration, because of insufficient regular expression validation. The CVSS vector is network, low complexity, no privileges, no user interaction and a changed scope.

Rapid7 reproduced code execution on the official GitLab 19.4.1 CE image with address space layout randomization on, and saw no execution on the patched 19.4.2 image. In its description, a regular expression first compiles in a compact US-ASCII form and passes GitLab's validation. It is then recompiled for UTF-8 when matched against a specially formed repository path, and an integer overflow in the compiler's program-size calculation produces invalid instructions. The command runs as the GitLab git user.

Rapid7 notes that its route needs the attacker to place a malicious CI/CD configuration and a specially named path in a public project first. On instances where new users can register and create projects, that step is easy. Rapid7 says this conflicts with the "no privileges" rating and that it does not know how the private report avoids it.

In Brandefense's dark web and Telegram monitoring, we found 23 posts naming this CVE between 12 and 22 October 2026. Seventeen repeat advisories or news and six point to public proof-of-concept repositories or report on them. GitHub search metadata showed three repositories claiming a proof of concept. Treat unverified repositories with care. We did not open or run any code.

GitLab CE and EE, all deployment types: all versions from 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. Fixed in 19.2.8, 19.3.5 and 19.4.2. GitLab.com was already patched and Dedicated tenants did not need to act.

These fixed versions are not the end of the story. CVE-2026-110264, fixed by GitLab on 21 October 2026, affects 19.2.8, 19.3.5 and 19.4.2 as well. Move to 19.2.9, 19.3.6, 19.4.3 or 19.5.1.