CISA Adds Actively Exploited GitLab Code Execution Flaw to KEV

CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) catalogue on 29 October 2026. The vulnerability affects GitLab Community Edition and Enterprise Edition and could let an unauthenticated attacker execute arbitrary code on a GitLab server using a specially crafted regular expression in a CI/CD configuration.

The flaw is an integer overflow or wraparound caused by insufficient validation of regular expressions. The attack targets the CI/CD configuration and requires no authentication, according to the supplied vulnerability description. The vulnerability has a CVSS score of 10.0, rated Critical. GitLab has made a patch available in its 19.4.2 patch release. The notes say other products may also be affected by the underlying Ruby/Onigmo issue in the CI/CD regular expression compiler.

A KEV listing indicates that active exploitation has been confirmed. The available data does not confirm whether attackers have used the flaw in ransomware campaigns; that information is unknown. CISA’s remediation deadline is 1 November 2026.

CISA requires organisations to apply mitigations in accordance with vendor instructions and comply with applicable BOD 26-04 guidance and CISA’s Forensics Triage Requirements. If mitigations are unavailable, agencies should follow the applicable BOD 26-04 guidance for cloud services or discontinue use of the product. Federal Civilian Executive Branch (FCEB) agencies are directly affected by CISA’s directive. All organisations should review their GitLab exposure, including internet-facing assets, and apply the available patch in line with relevant guidance.

For full details, consult the [NVD entry](https://nvd.nist[.]gov/vuln/detail/CVE-2026-97229) and [CISA KEV catalogue](https://www.cisa[.]gov/known-exploited-vulnerabilities-catalog).