Report
GitLab patches critical CVSS 10.0 RCE vulnerability in CI/CD regex compiler
A post says Rapid7's proof-of-concept demonstrates unauthenticated command execution, but the attack requires write access to a public project.
TLDR
Posts describe CVE-2026-97229 as a CVSS 10.0 integer-overflow flaw in GitLab's regex compiler that can lead to command execution through the public CI lint endpoint. One post says Rapid7's proof-of-concept demonstrates unauthenticated execution under certain conditions, but building the attack chain requires write access to a public project. The posts list 19.2.8, 19.3.5 and 19.4.2 as fixed versions.
Combined views
4.6K
2 Sources, first seen ago
