S2W_DailyThreat (@S2W_DailyThreat) on X

What it is

CVE-2026-97229 is a CVSS 3.1 10.0 (Critical) remote code execution flaw in the CI/CD regex compiler of self-managed GitLab CE and EE, disclosed October 13, 2026. S2W's post is a short advisory relaying GitLab's rating and Rapid7's research.

How it works

Insufficient regex validation combined with an integer overflow during encoding conversion can lead to arbitrary code execution on the server. An attacker with rights to add CI/CD config supplies a malicious regex and a UTF-8 repository path, and commands run as the git user. The post says this can affect server data, repositories and pipeline resources. It gives no further detail on the overflow itself.

Preconditions / Affected

• Self-managed GitLab only. Fixed in 19.2.8, 19.3.5 and 19.4.2. Affected: 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2.
• The attacker needs the right to add CI/CD config. On instances that allow public project creation or untrusted CI config rights, that bar may be low. The post implies this through its mitigations but does not say it outright.

What to do

1. Upgrade to 19.2.8, 19.3.5 or 19.4.2, whichever matches your release line.
2. If you cannot patch immediately, S2W advises layering these interim measures: - Restrict web interface access to a management network or VPN. - Limit public project creation. - Limit untrusted users' CI config rights.
3. If an externally exposed instance cannot be restricted, S2W suggests considering suspending the service until it is patched.

Caveats

• No official workaround exists. The measures above only reduce who can reach the flaw, and the post does not claim they fully close it.
• Rapid7 has published technical analysis and reproduction, and a public PoC exists. No in-the-wild exploitation was confirmed as of October 15, 2026, so the exploitation window may be short.
• The post is a secondary summary. Check GitLab's own advisory for the authoritative version list before acting.