x.comthread!Manan (@0xManan) on X
Social post describing CVE-2026-97229, a CVSS 10 unauthenticated RCE in GitLab CE/EE. A crafted .gitlab-ci.yml with a UTF-8 path passes validation under US-ASCII, then is recompiled by the Onigmo regex engine, where an integer wraps at INT_MAX. That gives attacker-controlled VM ops and system() execution as the git user. The chain is to push a payload to a public project, then call unauthenticated GET /api/v4/projects/:id/ci/lint. It links a Rapid7 PoC and writeup and lists fixed self-managed versions 19.2.8, 19.3.5 and 19.4.2. GitLab.com is already patched.
TL;DR Unauthenticated CVSS 10 GitLab RCE via an Onigmo integer overflow reached through the CI lint API. A Rapid7 PoC is public; patch to 19.2.8, 19.3.5 or 19.4.2.
CVEs named here
Technologies named here
- Rapid7 PoC
- GitLab.com
- Rapid7 writeup
- GitLab CI lint API
- Onigmo
- GitLab
- Rapid7
Techniques named here
- Attacker-controlled VM ops leading to system execution
- Integer Overflow
Related in AppSec
github.comadvisoryFlowise MCP Security Bypass Enables RCE
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
github.comrepoOASIS
blog.trailofbits.comwriteup