PoC Exploit Released for Critical GitLab RCE Vulnerability (CVE-2026-97229)

A public proof-of-concept (PoC) for CVE-2026-97229 published by researcher Jonah Burgess shows how a flaw in GitLab’s CI/CD regular-expression compiler could be used to run commands on a vulnerable server.

GitLab rates the issue Critical with a CVSS score of 10.0. The exploit code is publicly available, raising the risk for organizations that have not yet installed the security updates.

The PoC targets GitLab Community Edition and Enterprise Edition. Its author reports testing the included exploit layout against the official Linux amd64 GitLab CE 19.4.1 image. The code uses GitLab’s CI lint endpoint, which checks CI/CD configuration files, as part of the exploit chain.

The exploit has an important access condition. The attacker needs permission to push a branch to a public project on the affected GitLab instance. The PoC then sends a later request to the CI lint endpoint without a token, cookie, or other authorization header.

Jonah Burgess says the command runs as GitLab’s git account, not as an administrator. The public code is an initial release, and its author says further analysis of affected configurations and other possible paths is ongoing.

PoC Exploit Released for Critical GitLab Vulnerability

GitLab’s advisory describes CVE-2026-97229 as an integer overflow in the CI/CD regular-expression compiler. The PoC details a chain in which CI lint reads a crafted pipeline configuration from an attacker-controlled branch and processes a regular expression against specially named repository paths.

A Unicode path causes Ruby to compile the expression again after GitLab’s size check. The exploit authors say this leads to an integer overflow that redirects the regular-expression engine’s execution and reaches a command-execution function.

The repository reports that the test request usually ends with an HTTP 502 error because the worker process crashes after the command runs. That response alone does not confirm successful exploitation.

Jonah Burgess author’s tests, command output returned through a callback indicated execution. The PoC also requires substantial memory, and the published layout is specific to one GitLab build. The author warns that low memory or multiple concurrent requests could instead disrupt service.

GitLab says the flaw affects CE and EE versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. The company released those fixed versions on October 12, 2026, and strongly recommends that self-managed installations upgrade promptly.

GitLab.com is already running a patched version, while GitLab Dedicated customers do not need to take action. Administrators should confirm their version and upgrade to the fixed release for their branch or a later supported version.

They should also review recent changes to CI/CD configuration files, especially new or modified regular expressions and project branches. GitLab’s earlier CI/CD regex security coverage and previous security-update reporting provide additional context on why these pipeline components deserve close review.

This PoC does not establish that the vulnerability is being used in real-world intrusions. However, it gives defenders a concrete reason to prioritize patching: the issue has the highest CVSS rating, and public exploit code describes a path from project write access to command execution on a vulnerable server.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.