CVE-2026-97229

Summary

A vulnerability in GitLab's CI/CD configuration processing allows unauthenticated attackers to execute arbitrary code on the server by injecting malicious regular expressions. This represents a critical remote code execution risk that could be exploited without any authentication or user interaction.

Exploitability

Exploitation is straightforward for unauthenticated users who can submit CI/CD configuration files, requiring only a specially crafted regex pattern that bypasses validation checks to achieve remote code execution.

Blast radius

If exploited, this vulnerability could allow attackers to fully compromise GitLab servers, potentially leading to data breaches, persistence mechanisms, and further lateral movement within affected environments.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to GitLab 19.2.8, 19.3.5, or 19.4.2 depending on your current version to remediate this critical RCE vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.