GitLab 19.4.2: critical RCE CVE-2026-97229 in CI/CD regex
GitLab fixes 24 vulnerabilities in CE/EE, including CVE-2026-97229 (CVSS 10) in the CI/CD regular expression compiler. Affected versions and what to do now.
📌 Later developments: GitLab CVE-2026-110264: LDAP injection and request smuggling too (October 22, 2026) · GitLab 19.5.1: new unauthenticated RCE, CVE-2026-110264 (October 22, 2026) · GitLab CVE-2026-97229: Rapid7 reproduces RCE, 19.3 fix is 19.3.5 (October 12, 2026)
On 12 October 2026 GitLab released versions 19.4.2, 19.3.4 and 19.2.8 of GitLab Community Edition (CE) and Enterprise Edition (EE). According to CERT-EU advisory 2026-016, the updates fix 24 security issues, including a critical vulnerability that could allow an unauthenticated attacker to execute arbitrary code on the server. On the same day CERT-FR published advisory CERTFR-2026-AVI-1294, which lists 24 CVE identifiers.
In September ARX News covered CVE-2026-85706, the already exploited path traversal fixed in versions 19.1.8, 19.2.6 and 19.3.2. The fixed versions of that time are also affected by these new vulnerabilities: if you stopped there, you need to update again.
What happened
According to CERT-EU, the most severe vulnerability, CVE-2026-97229 with a CVSS score of 10.0, is located in the CI/CD regular expression compiler. Weak validation of regular expressions leads to an integer overflow; a specially crafted expression in a CI/CD configuration can then trigger code execution. The advisory does not describe how the attacker gets the expression processed.
CERT-EU strongly recommends upgrading all self-managed GitLab CE/EE instances as soon as possible, starting with internet-facing ones. Neither source reports active exploitation.
Technical details
The other vulnerabilities described by CERT-EU:
- CVE-2026-92883 (CVSS 8.7): cross-site scripting in syntax highlighting; an authenticated user can run arbitrary JavaScript in other users’ browsers through a crafted repository.
- CVE-2026-16301 (CVSS 8.5): an authorisation flaw that lets a user with the developer role run pipelines on protected branches without permission.
- 21 further issues, including a cache poisoning bug rated 8.2 that could expose protected CI/CD variables.
CERT-FR does not describe the individual vulnerabilities, but lists the overall risks: remote arbitrary code execution, breach of data confidentiality and integrity, security policy bypass, server-side request forgery (SSRF) and cross-site scripting (XSS).
Affected versions according to CERT-FR:
- GitLab CE and EE 19.4.x before 19.4.2;
- GitLab CE and EE 19.3.x before 19.3.4;
- GitLab CE and EE before 19.2.8.
CERT-EU gives the same thresholds for self-managed instances. The advisories list no fix for the 19.1 branch: 19.1.8 is also earlier than 19.2.8.
Fixed versions: 19.4.2, 19.3.4 and 19.2.8.
CVEs listed by CERT-FR: CVE-2026-100104, CVE-2026-100755, CVE-2026-101168, CVE-2026-103549, CVE-2026-104661, CVE-2026-105458, CVE-2026-14210, CVE-2026-14552, CVE-2026-14814, CVE-2026-16275, CVE-2026-16301, CVE-2026-5954, CVE-2026-6567, CVE-2026-7767, CVE-2026-78335, CVE-2026-81839, CVE-2026-82632, CVE-2026-84284, CVE-2026-85529, CVE-2026-92528, CVE-2026-9268, CVE-2026-92883, CVE-2026-96893, CVE-2026-97229.
Both advisories refer to GitLab’s bulletin of 12 October 2026 (patch release 19.4.2) for the details of each fix.
Impact for European and Italian companies
A GitLab server usually holds source code, pipeline configurations and credentials for integrations. The critical vulnerability affects the CI/CD engine itself, and the other fixes include unauthorised access to pipelines on protected branches and possible exposure of protected CI/CD variables: these are the places where the secrets used for releases are usually kept.
For entities within the scope of NIS2, vulnerability management and software supply chain security are part of the required measures. A compromised GitLab instance can also affect the software delivered to customers and partners. In the event of a significant incident, in Italy the notification goes to CSIRT Italia at ACN.
What to do now
- Inventory: identify all self-managed GitLab instances, with edition (CE or EE) and version, and check which ones are reachable from the internet.
- Update: bring every instance to 19.4.2, 19.3.4 or 19.2.8, or later, starting with internet-facing ones, as CERT-EU recommends. Instances updated in September to 19.1.8, 19.2.6 or 19.3.2 need to be updated again.
- 19.1 branch: the advisories do not give a fixed version; move at least to 19.2.8.
- Read GitLab’s bulletin of 12 October 2026 for the details of each CVE and any guidance from the vendor.
- Check your pipelines: after updating, review in the logs the pipelines recently run on protected branches and the changes to CI/CD configurations. If you find anomalous activity, treat the secrets used by the pipelines as exposed and replace them.
How ARXDOME helps
ARX Expose shows which services your company exposes on the internet, which products are recognised on them and which have known vulnerabilities: it helps you find out whether a GitLab instance can be reached from outside. ARX Shield lists the open vulnerabilities on the monitored machines. ARX Sentry collects logs and events from the servers where the agent is installed and checks file integrity in the chosen folders. With ARX Horizon you can look up vulnerability details from the portal.
Last updated:
