A recent code execution vulnerability in GitLab was exploited one week after disclosure in a failed attack against Alpine Linux’s instance.
Tracked as CVE-2026-97229 (CVSS score of 10/10), the flaw stems from insufficient regular expression validation in Onigmo, Ruby’s regular expression engine.
The bug “could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration,” GitLab noted in an October 12 advisory.
According to Alpine Linux, a threat actor targeted its GitLab instance with a CVE-2026-97229 exploit on October 20 and 21. The attack failed, but the Linux distribution rebuilt the instance from scratch.
“Our checks show that the aports repository, packages, and the October 21 releases were not tampered with,” Alpine Linux notes.
It is still testing the GitLab instance before public release, and has reset all passwords, warning of observed automated login attempts using passwords compromised in other leaks.
As part of the October 20-21 attack, the hackers used a newly registered account to send crafted CI configurations to Alpine Linux’s GitLab instance, crashing the worker process.
“In 4 of those crashes, the attacker got partway through the exploit and failed at the next step. The attacker also downloaded our GitLab container image, which suggests they were tuning the exploit to our exact build. We have found no evidence that the attacker ran code on the server, but we cannot rule it out,” Alpine Linux says.
Because the underlying vulnerability resides in Ruby, not in GitLab, and the Linux distribution’s image runs standard Ruby, the vulnerability was not patched after updating to GitLab 19.3.6.
“If you run GitLab with your own Ruby (from source or in your own container image) rather than GitLab’s packages, upgrading GitLab is not enough: you also need Ruby 3.3.13, 3.4.12, 4.0.9 or later,” Alpine Linux notes.
On Thursday, the US cybersecurity agency CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within three days, as mandated by BOD 26-04.
Related: TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines
Related: Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities
Related: Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
Related: Hackers Start Probing Fresh Oracle EBS Vulnerability
