Rapid7 turns GitLab's CVSS 10.0 regex overflow into command execution on an official 19.4.1 image
Rapid7 built a working command-execution exploit for GitLab's CVSS 10.0 CI/CD regex overflow, CVE-2026-97229. Rapid7 says its route needs a malicious CI config pushed to a public project first, a prerequisite that conflicts with GitLab's PR:N rating.
The Watch · Security desk
The PoC writes its quantifier bound as {5(?#)7805}. Before the (?#) comment sits a 5; after it sits 7805. Onigmo ignores the inline comment and reads the bound as 57,805.
Number read from the PoC's {5(?#)7805} In value read
| Item | Value | Claim |
|---|---|---|
| Digits before the (?#) comment | 5 value read | 13 |
| Digits after the (?#) comment | 7,805 value read | 13 |
| Bound Onigmo reads | 57,805 value read | 13 |
What happened
- GitLab shipped 19.4.2, 19.3.5 and 19.2.8 on October 12, 2026 to fix an integer overflow in how it handles CI/CD regular expressions.
- GitLab.com was patched before disclosure, and Dedicated customers do not need to act.
- Rapid7's PoC reliably runs arbitrary commands as GitLab's git account on the official gitlab-ce 19.4.1 Linux amd64 image with ASLR enabled.
- GitLab's release notes do not report exploitation in the wild at the time of disclosure.
Why it matters
- Who's exposed exposure Installs on 19.2 below 19.2.8, 19.3 below 19.3.5 or 19.4 below 19.4.2 are in scope on every deployment type unless GitLab says otherwise, so the upgrade falls to the operator.
- What doesn't add up contradiction Rapid7 cannot say whether the reported attack needs the push step, so operators cannot count it as a control while the HackerOne report stays private.
- Who has to decide decision A PoC that runs commands reliably on an official image with ASLR on removes the usual reason to wait for more detail, so self-managed operators on these lines face a patch-now call.
The flaw sits in how GitLab handles regular expressions that CI rules run against repository paths. Both rules:exists:regexp and rules:changes:regexp support that matching [8], and one way to get an expression evaluated during static configuration processing is to put it on a conditional include [9]. Each match then crosses from CI configuration into native Onigmo with a repository path as the subject [10].
GitLab wraps those expressions in limits. It checks source length, rejects subroutine calls and large repeat bounds, rejects compiled objects over one megabyte, and attaches a 50-millisecond timeout [11]. The repeat-bound scanner recognizes only contiguous digits [12]. Rapid7's PoC writes the bound as {5(?#)7805}. The (?#) is an inline regex comment, Onigmo ignores it, and the engine reads the bound as 57,805 [13].
Rapid7 analyzed one end-to-end route [15]. It starts after the attacker has pushed the malicious CI configuration and a specially named path to a public project, and only the final CI lint request is unauthenticated [15]. GitLab's description of the flaw is possible code execution by an unauthenticated user [3]. Rapid7 wrote that "because the underlying report remains private, we do not yet know how the reported attack avoids it" [17].
Public: GitLab's advisory, the fixed builds, which are four days old as of October 16 [14], and Rapid7's analysis of that one route. Private: joaxcar's HackerOne report [2], which Rapid7 says remains private [16].
What to watch
- Publication of joaxcar's HackerOne report, which would show whether the reported attack skips the public-project push that Rapid7's route needs.
- Any report of exploitation in the wild; GitLab's release notes reported none at disclosure.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence65
- Adoption
- Not scored
- Hype gap−10
- Incentives
- Not scored
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
On October 12, 2026, GitLab released 19.4.2, 19.3.5 and 19.2.8 to fix CVE-2026-97229, an integer overflow in its CI/CD regular-expression handling.
- [2]
The issue was reported through HackerOne by joaxcar.
- [3]
GitLab assigned CVE-2026-97229 a CVSS score of 10.0 and described possible code execution by an unauthenticated user.
- [4]
The advisory states CVE-2026-97229 affects GitLab CE and EE from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2; GitLab says all deployment types are affected unless stated otherwise.
- [5]
GitLab.com was patched before disclosure, and Dedicated customers do not need to act.
- [6]
Rapid7 researchers developed an end-to-end PoC that reliably runs arbitrary commands as GitLab's git operating-system account on the official Linux amd64 gitlab/gitlab-ce:19.4.1-ce.0 image with ASLR enabled.
- [7]
GitLab's release notes do not report exploitation in the wild occurring at the time of disclosure.
- [8]
GitLab supports regular-expression matching over repository paths in rules:exists:regexp and rules:changes:regexp.
- [9]
One way to evaluate such an expression during static configuration processing is to place it on a conditional include.
- [10]
Each iteration of the path match crosses from CI configuration into native Onigmo with a repository path as the match subject.
- [11]
GitLab's wrapper checks source length, rejects subroutine calls and large repeat bounds, rejects compiled objects over one megabyte, and attaches a 50-millisecond timeout to the final compiled expression.
- [12]
GitLab's repeat-bound scanner recognizes only contiguous digits.
- [13]
The PoC hides its quantifier bound from the scanner with an inline comment, {5(?#)7805}; (?#) is an inline regex comment that Onigmo ignores, and Onigmo reads the bound as 57,805.
- [14]
The fixed GitLab builds were released four days before October 16, 2026.
- [15]
Rapid7's analysis covers one end-to-end route. It begins after an attacker has pushed both the malicious CI configuration and a specially named path to a public project; only the final CI lint request is unauthenticated.
- [16]
Rapid7 says the prerequisite of pushing to a public project conflicts with GitLab's PR:N rating, and the underlying report remains private, so Rapid7 does not yet know how the reported attack avoids it.
- [17]
Rapid7 wrote: "That prerequisite conflicts with GitLab's PR:N rating, and because the underlying report remains private, we do not yet know how the reported attack avoids it."
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- blog.rapid7.comRapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)
1 article · October 16, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Regular expression securityFollow
- CI/CD Pipeline SecurityFollow
- Vulnerability researchFollow