A public proof-of-concept (PoC) for CVE-2026-97229, published by researcher Jonah Burgess, demonstrates how a flaw in GitLab’s CI/CD regular-expression compiler can be abused to run commands on a vulnerable server.
GitLab has rated the issue Critical with a CVSS score of 10.0. Because exploit code is publicly available, organizations that have not applied the security updates face an increased risk.
The PoC targets both GitLab Community Edition (CE) and Enterprise Edition (EE). Burgess reports testing the exploit layout against the official Linux amd64 GitLab CE 19.4.1 image. The code leverages GitLab’s CI lint endpoint, which validates CI/CD configuration files, as part of the exploitation chain.
The exploit requires a specific access condition: an attacker must have permission to push a branch to a public project on the targeted GitLab instance. The PoC then makes a subsequent request to the CI lint endpoint without supplying a token, cookie, or other authorization header.
Burgess states the executed command runs under GitLab’s git account rather than as an administrator. The public release is an initial version of the PoC, and the author says further analysis of affected configurations and other potential attack paths is ongoing.
PoC Exploit Released for Critical GitLab Vulnerability
GitLab’s advisory describes CVE-2026-97229 as an integer overflow in the CI/CD regular-expression compiler. The PoC outlines a chain where CI lint reads a crafted pipeline configuration from an attacker-controlled branch and processes a regular expression against specially named repository paths.
A Unicode path causes Ruby to recompile the expression after GitLab’s size check. According to the exploit author, that sequence can trigger an integer overflow that redirects the regular-expression engine’s execution flow and reaches a command-execution function.
The repository notes that the test request typically ends with an HTTP 502 error because the worker process crashes after the command runs; that error response alone does not prove successful exploitation.
In Burgess’s tests, command output was returned via a callback, indicating execution. The PoC also requires substantial memory, and the published exploit layout is specific to a particular GitLab build. The author warns that low available memory or multiple concurrent requests could instead cause service disruption.
GitLab says the flaw affects CE and EE releases 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. The company released fixed versions on October 12, 2026, and strongly recommends that self-managed installations upgrade promptly.
GitLab.com is already running a patched version, and GitLab Dedicated customers do not need to take action. Administrators should check their GitLab version and upgrade to the fixed release for their release line or to a later supported version.
Administrators should also review recent changes to CI/CD configuration files—particularly newly added or modified regular expressions and recently created project branches. GitLab’s prior coverage of CI/CD regex security and earlier security-update reporting provide additional context on why these pipeline components warrant careful review.
This PoC does not prove the vulnerability is being used in active intrusions. However, it gives defenders a concrete reason to prioritize patching: the issue carries the highest CVSS rating, and the public exploit code describes a path from project write access to command execution on a vulnerable server.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
