CISA Adds Critical GitLab CI/CD Regex Flaw CVE-2026-97229 to Exploited Vulnerabilities List

CISA added CVE-2026-97229, a critical GitLab Community Edition and Enterprise Edition vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog on October 29, 2026, meaning the agency has evidence it is being exploited in the wild.

The flaw is an integer overflow or wraparound (CWE-190) in GitLab's CI/CD regular expression compiler. GitLab says it could allow an unauthenticated user to execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. GitLab rates it CVSS 10.0.

Affected versions are GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. GitLab fixed the issue in versions 19.4.2, 19.3.5, and 19.2.8, released October 12, 2026, and said GitLab.com and GitLab Dedicated were already patched. GitLab has also published six threat detections to help self-managed customers spot exploitation attempts.

CISA set a November 1, 2026 remediation deadline for federal agencies and flagged the entry for forensic triage. CISA lists ransomware use as unknown. It also noted that other products could be affected by the same underlying Ruby/Onigmo integer overflow issue.