Max-Severity GitLab Vulnerability Exploited Against Alpine Linux

What it is

CVE-2026-97229 (CVSS 10) is a code execution flaw in Onigmo, Ruby's regular expression engine, caused by insufficient regular expression validation. GitLab's 12 October 2026 advisory says an unauthenticated user could run arbitrary code on the GitLab server through a crafted regular expression in a CI/CD configuration. Alpine Linux's own GitLab instance was attacked about a week after that disclosure.

How it works

The page gives the attack as observed, not the exploit internals. The attacker registered a new account and sent crafted CI configurations to Alpine's instance, which crashed the worker process. In 4 of those crashes the attacker got partway through the exploit and failed at the next step. The attacker also downloaded Alpine's GitLab container image, which Alpine reads as the attacker tuning the exploit to its exact build.

Preconditions / Affected

The bug is in Ruby, not GitLab code, so updating GitLab alone does not always fix it. Alpine's image runs standard Ruby and stayed vulnerable after the update to GitLab 19.3.6. Installs using GitLab's own packages are covered by that update, as the page frames it. Installs that run GitLab from source or in a custom container image with their own Ruby are exposed until Ruby is updated.

What to do

• On self-managed installs with your own Ruby, upgrade GitLab and also move Ruby to 3.3.13, 3.4.12, 4.0.9 or later.
• Check which Ruby your image actually ships, not just the GitLab version.
• CISA added the CVE to its KEV catalog and set a three-day patch deadline for federal agencies under BOD 26-04. Treat that as the urgency benchmark.
• Look for the signals Alpine saw: repeated worker process crashes, CI configurations from recently registered accounts, and pulls of your GitLab container image.
• Reset credentials if you suspect exposure. Alpine reset all passwords and saw automated login attempts using passwords leaked elsewhere.

Caveats

The attack on Alpine failed. Alpine found no tampering with the aports repository, its packages or the 21 October 2026 releases, but says it found no evidence of code running on the server and "cannot rule it out". Alpine rebuilt the instance from scratch and was still testing it before public release. The page gives no exploit details or detection signatures beyond the observations above.