Paste your GitLab version into this CVE checker for an instant verdict on GitLab CVE-2026-97229 (CVSS 10.0). No signup, nothing installed, everything runs in your browser.
Short answer: GitLab 19.2.0–19.2.7, 19.3.0–19.3.4, and 19.4.0–19.4.1 are vulnerable to CVE-2026-97229, a CVSS 10.0 unauthenticated remote-code-execution flaw in the CI/CD regex compiler with a public proof-of-concept. If you run one of these, upgrade to 19.2.8, 19.3.5, or 19.4.2 now. Paste your version above for an instant verdict.
CVE-2026-97229 is top cybersecurity news because it scores a perfect CVSS 10.0 — a GitLab CI/CD remote-code-execution flaw exploitable without authentication. CI/CD systems hold deployment credentials, so compromise means supply-chain access to everything you ship. Check your GitLab version with the tool above and upgrade to the patched release.
.gitlab-ci.yml file. A config gets committed to a repository, then a request to the CI lint endpoint runs the crafted regex server-side.git system user inside an application worker. The official vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) means: network-reachable, low complexity, no privileges, no user interaction.Censys scanned the internet and reported as of October 13, 2026:
| Metric | Value |
|---|---|
| Hosts running vulnerable GitLab versions | 25,766 |
| Web properties tied to those hosts | 79,224 |
| Share of detected GitLab hosts unpatched | ~31% |
| Top countries: Germany | 6,469 hosts |
| Russia | 4,173 hosts |
| United States | 2,927 hosts |
Vulnerable version ranges: 19.2.0–19.2.7 → fixed in 19.2.8; 19.3.0–19.3.4 → fixed in 19.3.5; 19.4.0–19.4.1 → fixed in 19.4.2.
Sources: WebProNews (Oct 2026) · Censys advisory · Help Net Security
.gitlab-ci.yml commits for regex-heavy changes nobody on your team made.CVE-2026-97229 is an integer overflow in GitLab's CI/CD regular expression compiler, scored CVSS 10.0, affecting GitLab Community and Enterprise Editions. A crafted regex inside a .gitlab-ci.yml can trigger arbitrary code execution on the server. GitLab shipped fixes on October 12, 2026 and Rapid7 published a proof-of-concept on October 13.
GitLab's advisory lists 19.2.0 through 19.2.7, 19.3.0 through 19.3.4, and 19.4.0 through 19.4.1 as vulnerable. The fixed releases are 19.2.8, 19.3.5, and 19.4.2. Paste your version into the checker above for an instant verdict.
The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: attack over the network, low complexity, no privileges, no user interaction, changed scope, and full impact on confidentiality, integrity, and availability. The vulnerable code (the regex compiler) runs server-side, so exploitation can mean code execution as the git system user.
The attack path starts with a crafted .gitlab-ci.yml committed to a repository, then an unauthenticated request to the CI lint endpoint triggers the flaw. On instances with open self-registration, any internet user can plant that config, so treat it as fully unauthenticated; with sign-ups restricted, an attacker needs only one low-privilege account.
Upgrade out of cycle to 19.2.8, 19.3.5, or 19.4.2. If you cannot patch immediately: turn off open registration, restrict who can create projects, minimize CI secrets, isolate runners, review recent .gitlab-ci.yml commits for regex-heavy changes nobody made, rotate tokens and CI variables, and preserve logs for forensics. GitLab.com is already patched and Dedicated customers need no action.
A CVE checker is a free tool that tells you whether your software is affected by a published CVE — a publicly known cybersecurity vulnerability. It compares your version or configuration against the official advisory and gives you a patched, vulnerable, or unknown verdict in about 30 seconds.
Find your exact version number, then compare it against the vendor's security advisory or the NVD entry for the CVE. The fastest way is a CVE checker built for that product: paste your version and get an instant verdict against the published version tables.
You are affected when you run a vulnerable version and the vulnerable component is reachable or enabled — for example, open sign-ups, an exposed management port, or a vulnerable app installed. A CVE checker gives you the version verdict in seconds; the advisory's conditions tell you whether that verdict means real exposure.