pwned.coffeeOrder ticket · today's special · 26 Oct 2026

🔥 On the fly · exploited in the wildScalding · 540°CcriticalOrder up · fix available

GitLab: remote code execution

GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to…

Do this now

Upgrade GitLab to 19.4.2, 19.3.5, or 19.2.8 now, since this flaw is being exploited.

Fix it

GitLab

On 19.2.xUpgrade to GitLab 19.2.8
On 19.3.xUpgrade to GitLab 19.3.5
On 19.4.xUpgrade to GitLab 19.4.2

First seen: 26 Oct 2026
Last update: 26 Oct 2026, 15:17 UTC
Fixed in: 19.4.2
19.3.5
19.2.8
Identifiers: CVE-2026-97229
CVSS: 10.0
Source: news
On the menu as: GitLab

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## GitLab: remote code execution
Severity: critical, exploited in the wild. Patch status: patched.
Affected: GitLab
Fixed in: 19.4.2, 19.3.5, 19.2.8
Ids: CVE-2026-97229

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to…

## Steps
1. This touches infrastructure (gitlab). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.
2. Fix by release line: GitLab: 19.4.x → 19.4.2; 19.3.x → 19.3.5; 19.2.x → 19.2.8.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| GitLab 19.4.x | fixed | 19.4.2 | — |
| GitLab 19.3.x | fixed | 19.3.5 | — |
| GitLab 19.2.x | fixed | 19.2.8 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-97229") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/ https://nvd.nist.gov/vuln/detail/CVE-2026-97229
https://pwned.coffee/i/gitlab-remote-code-execution-cve-2026-97229

Timeline

26 Oct 2026, 15:17 UTC
Fix status: unknown → patched.
26 Oct 2026
First reported.

Receipt

Exploitation: Exploited: confirmed by the vendor
Vendor “Detecting CVE-2026-97229 Exploitation Attempts GitLab security has released six threat detections to support customers with self-managed instances, listed below.” source
Fix by release line: Product Affected Fixed in Source
GitLab 19.4 to before 19.4.2 19.4.2 CVE record (CNA) checked 26 Oct
GitLab 19.3 to before 19.3.5 19.3.5 CVE record (CNA) checked 26 Oct
GitLab 19.2 to before 19.2.8 19.2.8 CVE record (CNA) checked 26 Oct
Score: CVSS 10.0 (critical). CVSS 3.1 10 (CNA GitLab) for CVE-2026-97229
Last checked: 26 Oct 2026, 15:17 UTC

Product	Affected	Fixed in	Source
GitLab	19.4 to before 19.4.2	19.4.2	CVE record (CNA) checked 26 Oct
GitLab	19.3 to before 19.3.5	19.3.5	CVE record (CNA) checked 26 Oct
GitLab	19.2 to before 19.2.8	19.2.8	CVE record (CNA) checked 26 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee