GitLab CE/EE CVE-2026-97229

Exploitation requires the attacker to supply a specially crafted regular expression within a GitLab CI/CD configuration, triggering insufficient regex validation (tagged as an integer overflow). The vendor states this is reachable by an unauthenticated user only 'under certain conditions,' which is the primary limiting factor - the specific deployment/configuration that exposes the regex-validation path to an unauthenticated actor is not detailed in the available data and should be confirmed with GitLab. Exploitation is further bounded to the affected version ranges (19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2); patched instances are not affected. No user interaction is required (UI:N).

This is a genuine top-tier priority, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) describes unauthenticated, network-reachable, low-complexity remote code execution with a scope change and full confidentiality/integrity/availability impact - essentially the worst-case profile. Public exploit code is referenced (two HackerOne reports), which materially raises near-term risk even though this is distinct from confirmed active exploitation. SIGNAL TENSION TO VERIFY: the CVSS declares AC:L and PR:N (unauthenticated, low complexity), but the description qualifies the flaw with 'under certain conditions' and requires supplying a crafted regular expression in a CI/CD configuration - a surface that normally implies some project-level access; the 'low complexity / unauthenticated' rating and the conditional, config-dependent wording are in mild tension and should be confirmed against GitLab's advisory. No EPSS score and no KEV status were provided in the input, so widespread-exploitation probability cannot be quantified and active exploitation is NOT established - absence of KEV here means only that CISA has not listed it, not that it is safe. CWE-190 (integer overflow) tagged against a regex-validation RCE is plausible (overflow in regex engine length/count handling) but should be treated as the mechanism, not independently confirmed here.

An attacker submits a specially crafted regular expression within a CI/CD configuration to a vulnerable GitLab instance, triggering an integer overflow in the insufficient regex-validation path and executing arbitrary code on the GitLab server. Because the CVSS vector is AV:N/AC:L/PR:N with a scope change, the request is remote and (per the advisory) achievable without authentication under certain conditions. Public exploit code is referenced in two HackerOne reports, lowering the barrier to real-world attempts.