CVE- 2026-97229 is a critical, unauthenticated remote code execution flaw in GitLab’s CI/CD regular expression compiler, tracked as CWE-190 (integer overflow). GitLab reports a CVSSv3.1 score of 10.0, with exploitation possible when a malicious regular expression is crafted and stored in a CI/CD configuration. While the CVSS score implies unauthenticated access, rapid reproduction notes indicate an attacker must first plant a malicious CI/CD configuration in a repository prior to triggering the vulnerability.
On GitLab instances that allow new users to self‑register and create projects, this prerequisite is removed. The issue affects self‑managed GitLab CE and EE across all deployment types; GitLab[.]com is already patched, and GitLab Dedicated customers need not act.
Rapid7’s analysis confirms a feasible exploit chain: an attacker must commit a malicious .gitlab-ci[.]yml and a repository path containing UTF-8 characters to a public project. The crafted regular expression initially validates in US-ASCII, then Onigmo re-compiles against a valid UTF-8 path, triggering an integer overflow in the compiler’s program-size calculation and producing invalid regular expression instructions. This can allow attacker-controlled Onigmo VM operations to execute code as the GitLab user.
Rapid7 validated exploitation against the official 19.4.1 CE image with ASLR enabled; the patched 19.4.2 CE image blocks the chain. Affected versions include all 19.2.x before 19.2.8, all 19.3.x before 19.3.5, and all 19.4.x before 19.4.2. Immediate actions: upgrade to 19.2.8, 19.3.5, or 19.4.2; until then, restrict anonymous access to public projects and prevent untrusted users from creating or writing to them.