CVE-2026-97229 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-97229 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-97229 is a critical GitLab CE/EE vulnerability with a CVSS of 10.0. GitLab has fixed an issue affecting versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. Under certain conditions, an unauthenticated attacker could execute arbitrary code on the GitLab server by submitting a specially crafted regular expression in a CI/CD configuration, due to insufficient regex validation.

For solo developers and small teams, treat this as an urgent patch-now event. If your GitLab instance is internet-facing, the risk is especially high because no valid user session is required for exploitation. Even if you do not use advanced CI/CD features heavily, any repository with pipeline configuration may be exposed.

Immediate Action

  • Upgrade immediately to a fixed release: 19.2.8+, 19.3.5+, or 19.4.2+ depending on your branch.
  • If you cannot patch within hours, isolate GitLab from the public internet, restrict access by VPN/IP allowlist, and pause CI/CD pipeline changes.
  • Review recent pipeline/config changes for any regex-heavy CI/CD rules, includes, or template updates that may have been introduced before patching.
  • Take a backup/snapshot first if you manage GitLab yourself, then patch and restart during a maintenance window.
  • Check vendor guidance and release notes: GitLab Security Advisory (TODO link).

Affected Versions

  • GitLab CE/EE 19.2.x vulnerable for versions < 19.2.8; safe at 19.2.8+.
  • GitLab CE/EE 19.3.x vulnerable for versions < 19.3.5; safe at 19.3.5+.
  • GitLab CE/EE 19.4.x vulnerable for versions < 19.4.2; safe at 19.4.2+.
  • All earlier versions in these affected branches should be treated as vulnerable until confirmed otherwise by the vendor advisory.

Resolution Guide

GitLab package upgrades are the primary fix. Use the method that matches your installation.

# Omnibus GitLab on Debian/Ubuntu
sudo apt-get update
sudo apt-get install gitlab-ee=19.4.2-ee.0
sudo gitlab-ctl reconfigure
sudo gitlab-ctl restart

# Omnibus GitLab on RHEL/CentOS/Rocky
sudo yum update gitlab-ee-19.4.2-ee.0
sudo gitlab-ctl reconfigure
sudo gitlab-ctl restart

# If using GitLab CE instead of EE, replace gitlab-ee with gitlab-ce

# Docker image example
docker pull gitlab/gitlab-ee:19.4.2-ee.0
# Update your compose/k8s manifests to pin the fixed tag

Package managers for app dependencies are not usually the fix here, but if your team wraps GitLab in tooling or automation, update those clients too:

# npm / yarn / pnpm
npm audit
yarn audit
pnpm audit

# Python
pip-audit
pipx upgrade-all

# Java
mvn -q dependency:tree
./gradlew dependencies

Hardening while you patch:

# Example: restrict access at the network edge
# Allow only your office/VPN IPs to reach GitLab
# Block public access to the GitLab web UI until patched

# Example: temporarily disable CI/CD pipeline creation via policy
# (Use your GitLab admin settings or reverse proxy rules)

Minimal config safety idea: if you maintain internal templates, remove or comment out any regex-based CI/CD logic until the upgrade is complete.

# .gitlab-ci.yml example: temporarily avoid regex-driven rules
job:
  script:
    - echo "Temporarily disabled risky regex rule"
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'

Code fix example for custom tooling that validates user-supplied regex before sending it to GitLab:

// Example: reject overly complex or untrusted regex input
function isSafeRegex(input) {
  if (input.length > 128) return false;
  // TODO: replace with a strict allowlist for your use case
  return /^[a-zA-Z0-9_\-\.\*\?\^\$\|\(\)\[\]\\\\]+$/.test(input);
}

Detection & Verification

Check your installed version first:

sudo gitlab-rake gitlab:env:info
# or
sudo gitlab-ctl status
# or
gitlab-rake gitlab:env:info | grep -i version

Confirm you are not on a vulnerable build:

# Vulnerable if output shows:
# 19.2.x < 19.2.8
# 19.3.x < 19.3.5
# 19.4.x < 19.4.2

Search for regex-heavy CI/CD configs that may deserve extra review:

grep -RInE 'regex|regexp|rules:|only:|except:|if:' .gitlab-ci.yml .gitlab/ 2>/dev/null

Verify the fix after patching:

sudo gitlab-ctl restart
sudo gitlab-rake gitlab:env:info | grep -i version
# Confirm the version is 19.2.8+, 19.3.5+, or 19.4.2+

If you use a vulnerability scanner or asset inventory, re-run it against the GitLab host and confirm the instance no longer matches the vulnerable version range. For small teams, a simple post-upgrade screenshot or saved command output is enough evidence for the change record.

Risk and Impact

This flaw can let an attacker run arbitrary code on the GitLab server, which means full compromise of the application host is possible. For a small team, that can expose source code, CI/CD secrets, deploy keys, tokens, and private repositories in one incident.

Because GitLab often sits at the center of development workflows, the blast radius can extend beyond the server itself to production deployments and cloud infrastructure. Even without evidence of active exploitation, the severity is high enough that patching should be treated as an emergency.

Keep reading