GitLab up to 19.2.7/19.3.4/19.4.1 Regular Expression Validation incorrect regex

Summaryinfo

A vulnerability identified as critical has been detected in GitLab up to 19.2.7/19.3.4/19.4.1. Affected by this vulnerability is an unknown functionality of the component Regular Expression Validation. The manipulation leads to incorrect regex. This vulnerability is documented as CVE-2026-97229. The attack can be initiated remotely. Additionally, an exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in GitLab up to 19.2.7/19.3.4/19.4.1 and classified as critical. This issue affects some unknown functionality of the component Regular Expression Validation. The manipulation with an unknown input leads to a incorrect regex vulnerability. Using CWE to declare the problem leads to CWE-185. The product specifies a regular expression in a way that causes data to be improperly matched or compared. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

The advisory is shared at gitlab.com. The identification of this vulnerability is CVE-2026-97229 since 09/24/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are unknown but an exploit is available.

It is declared as attacked. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 10/29/2026 with a due date of 11/01/2026:

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BO

Upgrading to version 19.2.8, 19.3.5 or 19.4.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-3858). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Red Hat Enterprise Linux
• Open Source GitLab

Productinfo

Type

• Bug Tracking Software

Name

• GitLab

Version

• 19.2.0
• 19.2.1
• 19.2.2
• 19.2.3
• 19.2.4
• 19.2.5
• 19.2.6
• 19.2.7
• 19.3.0
• 19.3.1
• 19.3.2
• 19.3.3
• 19.3.4
• 19.4.0
• 19.4.1

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion