GitLab’s CI regex compiler is a CVSS 10.0 RCE, and CISA just put it on KEV

self-managed GitLab is still on 19.4.1? congratulations, your CI lint endpoint is a remote code execution gadget. CVE-2026-97229 is an integer overflow in the Onigmo regular expression compiler that GitLab reaches from crafted CI/CD configuration. CISA added it to KEV on October 29. federal due date November 1. the sloth brought a calendar and a frown.

what the KEV entry actually says

• CVE-2026-97229, unauthenticated user can execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
• CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) per GitLab. CISA flags forensic triage.
• notes: other products can be affected by the same underlying Ruby/Onigmo integer overflow in a CI/CD regexp compiler. see the Ruby advisory.
• fixed GitLab: 19.2.8, 19.3.5, 19.4.2. GitLab.com and Dedicated were patched before or at public release.

GitLab’s score says unauthenticated. Rapid7’s reproduction needed a way to plant a malicious .gitlab-ci.yml and a UTF-8 repository path, which on many self-managed instances is just “open registration plus a public project.” same blast radius, slightly more honest preconditions.

how the bug works, in sloth speed

1. GitLab compiles user regexes. CI configuration can carry patterns that hit Regexp.new in the Ruby worker.
2. ASCII passes the guard. the crafted pattern compiles in a compact US-ASCII form and sails through GitLab’s validation.
3. UTF-8 path forces a recompile. when the same pattern is evaluated against a specially formed valid UTF-8 repository path, Onigmo recompiles for the new encoding after those checks.
4. integer overflow in program size. the compiler’s size calculation wraps, invalid Onigmo VM instructions get emitted, and control flow in the Ruby process becomes attacker-shaped. Rapid7 got OS command execution as the git user on 19.4.1 with ASLR on.
5. Ruby is the root cause. the same Onigmo bugs sit under CVE-2026-89078, 93577, 97229, and 110264. any app that compiles untrusted patterns is in the blast radius, not just GitLab.

Regexp.timeout does not help. short patterns can still trigger it. “we limit regex length” is not a patch.

what to do before November 1

1. upgrade self-managed GitLab to 19.2.8, 19.3.5, or 19.4.2 immediately. do not wait for the next scheduled patch Wednesday.
2. if you vendor your own Ruby next to GitLab, move to Ruby 4.0.9 / 3.4.12 / 3.3.13. Omnibus ships a patched Ruby in those GitLab releases; source installs are on you.
3. until you can upgrade: disable open registration, block untrusted users from creating public projects, and restrict anonymous access to public projects. that cuts Rapid7’s demonstrated delivery path. it does not fix the compiler.
4. hunt with GitLab’s detections: Onigmo native worker crash, Graphql cilint hostile regexp, ci regexp oversized non ascii path, ci regexp guard rejection, ci lint workhorse worker crash, ci lint scripted client error burst.
5. also hunt quietly. Rapid7 notes a successful exploit may leave no crash. look for unexpected .gitlab-ci.yml commits, odd UTF-8 project paths, and child processes spawned from git-user workers around CI lint / GraphQL ciLint traffic.
6. rotate runner tokens, deploy keys, and any secrets that lived on the instance if you suspect compromise. forensic triage is not optional for federal systems; it is a good idea for everyone else too.

sloth take

compiling attacker regexes has been a bad idea since before Onigmo had a marketing name. GitLab turned that into a CVSS 10.0 on the CI lint path, patched mid-October, and still ended up on KEV two weeks later because someone used it. if your self-managed box is not on 19.4.2 / 19.3.5 / 19.2.8, you are running a known RCE with a Monday deadline. the sloth upgrades before brunch.

if your edge stack or storefront still has a KEV item open, get a second set of eyes before the federal deadline. Book a slot with Dark Edge Consulting.

sources

• CISA, “CISA Adds Two Known Exploited Vulnerabilities to Catalog” (October 29, 2026) and KEV entry for CVE-2026-97229
• GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8 (October 12, 2026)
• Ruby, “Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264” (October 23, 2026)
• Rapid7, “CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab”