Karen IT Security Response Center (KSRC) Advisory

Advisory ID: KSRC-2026-11023 | Publication Date: 02 November 2026

Critical Unauthenticated Remote Code Execution in GitLab CE/EE
CVE-2026-97229

Summary

A critical vulnerability has been identified in GitLab Community Edition (CE) and Enterprise Edition (EE) that allows an unauthenticated remote attacker to achieve Remote Code Execution (RCE) on the GitLab server. The vulnerability is tracked as CVE-2026-97229 and has been assigned a CVSS v3.1 score of 10.0 (Critical) — the maximum possible severity.

This vulnerability is being actively exploited in the wild and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on 29 October 2026. Organizations running self-managed GitLab instances are strongly urged to patch immediately.

Technical Overview

The vulnerability is classified as an Integer Overflow or Wraparound (CWE-190) in the CI/CD Regular Expression Compiler used by GitLab. When a specially crafted regular expression is supplied in a CI/CD configuration file (such as .gitlab-ci.yml), insufficient validation allows an integer overflow condition to occur during compilation of the regular expression pattern.

The vulnerable code resides in the Onigmo regular expression engine that is bundled with the Ruby runtime shipped by GitLab. Because GitLab packages its own Ruby, the fix is delivered through updated GitLab packages rather than a separate Ruby update in most official installations.

Successful exploitation allows an unauthenticated attacker to execute arbitrary code with the privileges of the GitLab service account, potentially leading to full compromise of the GitLab server, access to source code repositories, CI/CD secrets, and lateral movement within the environment.

Affected Systems

• GitLab CE/EE versions from 19.2 before 19.2.8
• GitLab CE/EE versions from 19.3 before 19.3.5
• GitLab CE/EE versions from 19.4 before 19.4.2

Fixed versions:

• 19.2.8
• 19.3.5
• 19.4.2

GitLab.com (SaaS) was already patched by GitLab. This advisory primarily concerns self-managed installations.

Exploitation Status

• Public proof-of-concept (PoC) code was released on 13 October 2026.
• CISA added the vulnerability to the KEV catalog on 29 October 2026.
• Federal agencies were required to remediate by 1 November 2026.
• Active exploitation in the wild has been confirmed.

Recommendations

1. Immediate Action: Upgrade all self-managed GitLab CE/EE instances to one of the fixed versions (19.2.8, 19.3.5, or 19.4.2) without delay.
2. If you are running GitLab on a custom or external Ruby installation (not the one bundled by official GitLab packages), ensure the underlying Ruby is also updated to a patched version (e.g., Ruby 3.3.13, 3.4.12, or 4.0.8+).
3. Review CI/CD configurations and recent pipeline activity for any suspicious or unusual regular expressions.
4. Monitor GitLab application logs, system logs, and process activity for signs of compromise (unexpected processes, outbound connections, or modified files).
5. If compromise is suspected, follow forensic triage procedures and rotate all secrets, tokens, and credentials stored in or accessible via the GitLab instance.
6. Restrict network access to the GitLab instance where possible, and ensure it is not unnecessarily exposed to the public internet.

Organizations that rely on GitLab for source control and CI/CD pipelines should treat this vulnerability as an emergency priority due to the combination of unauthenticated RCE, active exploitation, and the sensitive nature of the data typically held in GitLab environments.

Karen IT
We make the Internet harder to abuse.