CVE-2026-97229 (CVSS 10.0) is an integer overflow in the regular expression compiler that GitLab CI/CD uses. The root cause is in Onigmo, the regex engine inside Ruby. Per Rapid7, an unauthenticated attacker who can commit a crafted .gitlab-ci.yml to a branch in a public project may get code execution on the server. CISA added it to the KEV catalogue on 29 October 2026.
If you run GitLab yourself, here is a short checklist.
1. Find and patch
- Inventory every self-managed instance: production, staging, test and the one someone set up two years ago.
- Upgrade to a fixed release on your branch: 19.4.2, 19.3.5 or 19.2.8 (or any newer patch release). GitLab.com and GitLab Dedicated are already patched.
- Running a source install or a separately installed Ruby? The fix covers the Ruby bundled with the official Linux packages and container images, so check whether your Ruby also needs an update.
2. Shrink the attack path until patched
- Disable open self-registration and require admin approval for new users.
- Restrict who can create or push to public projects.
3. Hunt for misuse
- Review the threat detections GitLab published.
- Look at recent
.gitlab-ci.ymlchanges, especially in public projects. - Check for unknown users and projects.
- Look for unexpected processes running as the
gituser.
4. If compromise is possible
- Rotate CI/CD variables, deploy keys, runner tokens and any cloud credentials the server can reach.
- In India, organisations covered by CERT-In's April 2022 directions must report specified incidents within six hours of noticing them.
More detail: the full GitLab CVE-2026-97229 response guide for Indian teams
Written by the team at Affix Center, an IT services company in Lower Parel, Mumbai.
Top comments (0)