{"id":12308,"date":"2026-10-29T15:20:56","date_gmt":"2026-10-29T21:20:56","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/advisory-2026-131-critical-vulnerability-in-gitlab-cve-2026-97229-allows-rce-and-is-being-actively-exploited\/"},"modified":"2026-10-29T15:35:06","modified_gmt":"2026-10-29T21:35:06","slug":"alert-2026-131-critical-vulnerability-in-gitlab-cve-2026-97229-allows-rce-and-is-being-actively-exploited","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-131-critical-vulnerability-in-gitlab-cve-2026-97229-allows-rce-and-is-being-actively-exploited\/","title":{"rendered":"Alert 2026-131 Critical vulnerability in GitLab (CVE-2026-97229) allows RCE and is being actively exploited"},"content":{"rendered":"\n

Affected product(s):\u00a0<\/h2>\n\n
Product<\/strong><\/td>Affected versions<\/strong><\/td>Fixed version<\/strong><\/td><\/tr>
GitLab CE\/EE 19.2<\/strong><\/td>19.2.x versions earlier than 19.2.8<\/td>19.2.8 (19.2.9 recommended)<\/td><\/tr>
GitLab CE\/EE 19.3<\/strong><\/td>19.3.x versions earlier than 19.3.5<\/td>19.3.5 (19.3.6 recommended)<\/td><\/tr>
GitLab CE\/EE 19.4<\/strong><\/td>19.4.x versions earlier than 19.4.2<\/td>19.4.2 (19.4.3 recommended)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

All self-managed deployment types are affected; GitLab.com and GitLab Dedicated have already been fixed and require no action.<\/p>\n\n

Description<\/h2>\n\n

A maximum-severity vulnerability (CVSSv3.1 10 – CRITICAL) has been disclosed in GitLab Community Edition \u2014CE\u2014 and Enterprise Edition \u2014EE\u2014 that allows arbitrary code execution on the server through a specially crafted regular expression in the CI\/CD configuration. It has been assigned CVE-2026-97229. The vulnerability is being actively exploited and public proofs of concept (PoC) exist.<\/p>\n\n

The flaw is an integer overflow (CWE-190) in the size of a pattern compiled by Onigmo, the regular-expression engine for Ruby, which GitLab uses when processing CI\/CD regular expressions. The same Ruby defect is also associated with CVE-2026-93577. The vendor fixed it in its Critical Patch Release dated 12\/10\/2026. According to the published PoCs, the code runs with the privileges of the server’s git<\/code> user.<\/p>\n\n

The vendor describes it as exploitable by an unauthenticated user. However, researchers point out that the public exploitation chain requires the ability to push code to a public project, for which a regular account, an access token, or open registration on the instance is sufficient; the final step is an unauthenticated GET request to \/api\/v4\/projects\/:id\/ci\/lint<\/code>. Therefore, instances with open registration or public projects accessible from the Internet are the most exposed.<\/p>\n\n

Exploitation attempts against the GitLab instance of an open-source project (Alpine Linux) were recorded on 20 and 21\/10\/2026, causing server process crashes, followed by additional failed attempts on 25 and 26\/10\/2026; the attacker used a newly registered account. There is no evidence that code execution succeeded, although the project treated the instance as compromised and warned that a successful exploitation may leave no crashes or traces in the web logs.<\/p>\n\n

On 29\/10\/2026, the U.S. cybersecurity agency added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline of 01\/11\/2026.<\/p>\n\n

This vulnerability is distinct from CVE-2026-110264, addressed in Alert 2026-118: the patches from 12\/10\/2026 for CVE-2026-97229 do not fix CVE-2026-110264.<\/p>\n\n

Mitigation<\/h2>\n\n

The vendor does not offer an alternative solution (workaround), and limiting evaluation time (Regexp.timeout<\/code>) or the length of regular expressions does not protect against this vulnerability. Until the update is applied, the following general recommendations apply:<\/p>\n\n