CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab

What it is

CVE-2026-97229 is an integer overflow (CWE-190) in the Onigmo regex compiler, which GitLab CE/EE uses for CI/CD regex handling. GitLab rated it CVSS 10.0 and published a patch release on October 12, 2026. Rapid7's post is dated October 13, 2026.

How it works

• A crafted regex in .gitlab-ci.yml first compiles in a compact US-ASCII form and passes GitLab's validation.
• It is then evaluated against a valid UTF-8 repository path, and Ruby's Onigmo recompiles it for that encoding after validation has finished.
• The program-size calculation overflows during recompilation. That generates invalid regex instructions, control-flow integrity is lost, and attacker-controlled Onigmo VM operations run an OS command as the git user.

Preconditions / Affected

• The attacker needs a branch in a public project containing both the malicious .gitlab-ci.yml and a repository path with UTF-8 characters. The vendor's "unauthenticated" rating glosses over this. Where self-registration and project creation are open, any new account can meet it.
• Self-managed CE and EE are affected across all deployment types. GitLab.com is already patched, and Dedicated customers need no action.
• Rapid7 reproduced it on the official 19.4.1 CE Linux amd64 image with ASLR on. The official 19.4.2 CE image did not execute the same input.

What to do

• Upgrade self-managed instances to a fixed release immediately, outside the normal patch cycle. The page does not list the fixed versions beyond the 19.4.2 test result, so confirm them in GitLab's security advisory.
• If you cannot upgrade yet, restrict anonymous access to public projects. Also stop untrusted users from creating or writing to public projects.
• Rapid7 Exposure Command, Vulnerability Management and Nexpose customers get an authenticated check, expected in the October 13 content release.

Caveats

• The interim controls block only the delivery path Rapid7 demonstrated. They do not fix the vulnerable compiler, so other routes to plant a config (for example an existing account with write access) are not covered.
• No in-the-wild exploitation is confirmed as of publication.
• The root cause and exploit-chain details are deferred to a separate Rapid7 write-up.