GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
[POC] CVE-2026-97229 — CVE-2026-97229-PoC
GitLab CI lint integer-overflow RCE PoC for CVE-2026-97229, validated against the official 19.4.1 CE amd64 image
PoC: Gitlab-RCE-CVE-2026-97229
CVE-2026-97229: GitLab RCE Unauthenticated via CI Lint
[POC] CVE-2026-97229 — CVE-2026-97229-GitLab-CI-CD-Regex-Compiler-RCE
CVE-2026-97229 — GitLab CI/CD Regex Compiler RCE
PoC: gitlab-onigmo-scanner
Detection-only triage for GitLab CVE-2026-97229 (and CVE-2026-110264): grade a self-managed GitLab version plus its Ruby, catch the Oct-12-patch and custom-Ruby traps. No payloads, no network probes.
PoC: gitlab-rce-toolkit
CVE-2026-97229 + CVE-2026-110264 — GitLab Onigmo RCE Exploit Toolkit (CVSS 10.0)
PoC: CVE-2026-97229
CVE-2026-97229 an external exploit for GitLab CI lint regex RCE. It is used only against a live GitLab target with permission. It creates a project, pushes a malicious CI configuration, triggers the CI lint endpoint, and receives command output through an HTTP callback. This is for authorized security research only.
PoC: cve-2026-97229-lab
CVE-2026-97229 GitLab CI lint regex integer overflow RCE — InstaBox version matrix reproduction & libruby gadget reverse engineering
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free