Vendor incident, severity high

GitLab critical RCE (CVE-2026-97229, CVSS 10.0) via crafted regex in CI configuration, exploit attempt seen

Published October 29, 2026, updated October 31, 2026

GitLab fixed CVE-2026-97229, a CVSS 10.0 flaw that lets an attacker run code on a GitLab server through a crafted regular expression in a CI configuration. Alpine Linux said on 28 October that an attacker tried to exploit it on the project's own GitLab server a week after the fix was released. Alpine found no evidence that the attack worked.

What's affected

• gitlabevery version

What to do

1. Update self-managed GitLab servers to the release that fixes CVE-2026-97229
2. Review GitLab servers for signs of exploit attempts involving crafted regular expressions in CI configuration

Check whether you were affected

Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:

/pharon:check-incident gitlab-ci-regex-rce-2026-10

References

• https://thehackernews.com/2026/10/attacker-tried-to-exploit-alpine-linuxs.html

Notice gitlab-ci-regex-rce-2026-10, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.