securitytabs

CVE-2026-97229

Critical10.0

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

CVSS
10.0v3.1
EPSS (exploit probability)
0.5%45th pct
CISA KEV
Not listed

EPSS trendFIRST daily scores, last 90 days

FIRST EPSS held steady from 0.6% on 2026-10-13 to 0.5% on 2026-10-20, ranging 0.5%–0.6% across 7 daily scores.
2026-10-13 → 2026-10-20 · 7 days · 0.5%–0.6%
Daily values
FIRST EPSS daily scores for this CVE
Score dateEPSSPercentile
2026-10-200.5%44.8%
2026-10-190.5%44.7%
2026-10-180.5%44.7%
2026-10-160.5%44.6%
2026-10-150.5%44.6%
2026-10-140.6%45.2%
2026-10-130.6%45.0%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

  • gitlab gitlab

Coverage3 articles

References

Facts sourced from NVD, FIRST EPSS, and CISA KEV. Last synced 2026-10-21 07:34 UTC.

  • CVSS & description: NVD 2.0, fetched 2026-10-21 06:34 UTC
  • EPSS: FIRST EPSS, fetched 2026-10-21 07:34 UTC; score date 2026-10-20
  • KEV: CISA KEV, fetched 2026-10-21 07:34 UTC