No. CVE-2026-97229

A booby-trapped setup file can take over a GitLab server

Attack likelihood is EPSS, a daily estimate from FIRST.org of how likely this bug is to be used in attacks in the next 30 days.

The official description

GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

What people are saying

Social attention, not a count of victims. Posts shown as written; we don't vouch for them. Data by LunarCrush.

• Dark Web Informer · 259K followers · X
  More than 1,000 GitLab servers remain exposed to an actively exploited RCE flaw; CVE-2026-97229 The CVSS 10.0 vulnerability allows an unauthenticated attacker to execute arbitrary code through a malicious regular…Open post

Read-only check, change nothing, send nothing anywhere.
Is GitLab Community Edition and Enterprise Edition (CVE-2026-97229) installed or running on this machine or in this project?
1. Find every copy and its version (apps, packages, containers, lockfiles).
2. Compare each version against the vendor's fixed version for CVE-2026-97229. Quote the vendor page you used.
3. Report a table: where, version, fixed version, status (exposed / fixed / not installed / unsure).
4. List the exact update steps, but do not run them.

Code on GitHub

Repos named after this bug. Some are scanners or write-ups, some are working attack code. Do not run them on a machine you care about.

• jburgess-r7/CVE-2026-97229-PoC · 65 stars
• gandli/cve-2026-97229-lab · 2 stars
• AmpedWasTaken/CVE-2026-97229-GitLab-CI-CD-Regex-Compiler-RCE · 1 stars

Sources

• Vendor advisory (docs.gitlab.com)
• CISA Known Exploited Vulnerabilities catalog
• NVD record