{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-97229/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-97229/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-97229/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-97229/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-97229/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-97229"},"sightings":{"href":"/api/v1/sightings/cve-2026-97229"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-97229.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-97229\n\ninfo:\n  name: GitLab CE/EE < 19.2.8 / 19.3.5 / 19.4.2 - Unauthenticated RCE via Onigmo Integer Overflow\n  author: rapid7\n  severity: critical\n  description: |\n    GitLab CE/EE 19.2.0–19.2.7, 19.3.0–19.3.4, and 19.4.0–19.4.1 contain a remote code execution caused by insufficient regular expression validation in CI/CD configuration, letting unauthenticated users execute arbitrary code remotely, exploit requires crafted regex in CI/CD config\n  impact: |\n    Unauthenticated attackers can execute arbitrary code on the GitLab server, potentially leading to full system compromise.\n  remediation: |\n    Upgrade to GitLab CE/EE 19.2.8, 19.3.5, 19.4.2 or later.\n  reference:\n    - https://github.com/jburgess-r7/CVE-2026-97229-PoC\n    - https://www.rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab\n    - https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-97229\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10.0\n    cve-id: CVE-2026-97229\n    epss-score: 0.6522\n    epss-percentile: 0.99256\n    cwe-id: CWE-190\n  metadata:\n    max-request: 2\n    verified: true\n    vendor: gitlab\n    product: gitlab\n    shodan-query: product:\"GitLab\"\n    fofa-query: app=\"GitLab\"\n  tags: cve,cve2026,gitlab,rce,critical,kev,cicd,onigmo,regex,unauthenticated,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /users/sign_in HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(to_lower(header), \"x-gitlab-meta\")'\n        internal: true\n\n  - raw:\n      - |\n        POST /api/v4/ci/lint HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Accept: application/json\n\n        {\"content\":\"stages:\\n  - scan\\ncve_97229_probe:\\n  stage: scan\\n  rules:\\n    - exists:\\n        regexp: \\\"{5(?#)7805}\\\"\\n  script:\\n    - echo 1\\n\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'regex(\"valid.{0,5}true\", body)'\n          - 'regex(\"errors.{0,5}\\\\[\\\\]\", body)'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: gitlab_version\n        part: header\n        regex:\n          - '(?i)x-gitlab-meta:\\s*\\{\"version\"\\s*:\\s*\"([^\"]+)\"'\n        group: 1\n# digest: 4b0a004830460221009bc21431a543bdbdd1108b6ba975cc8f8ed1a61f0668fb72edfffd8e1c6bc6e2022100c9144e1f05a8495f07710ca94c22c5e1bbf90aabe41e1803c13258794e28e975:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-97229"}