Regular expressions have been giving developers headaches for decades. GitLab has now shown that one carefully crafted regex can also give an attacker code execution on your server.
One Crafted Regex, Full Server Access
CISA confirmed on October 29 that attackers are exploiting CVE-2026-97229, a maximum-severity flaw in GitLab's CI/CD Regular Expression Compiler, the component that parses and evaluates regexes in pipeline configuration files. It's an integer overflow, and under certain conditions GitLab says an unauthenticated user could "execute arbitrary code on the GitLab server" with a crafted expression. Fixes are in GitLab CE and EE 19.4.2, 19.3.5 and 19.2.8, and federal agencies had until November 1 to patch.
GitLab has released threat detections for self-managed customers after seeing exploitation attempts. Shadowserver tracks nearly 2,800 internet-exposed GitLab CE instances, though it hasn't said how many are patched. CISA has now flagged six GitLab vulnerabilities as exploited since November 2021.
Alpine's Uncomfortably Close Call
Alpine Linux disclosed what one of these attacks looks like up close. According to reporting on its disclosure, an attacker sent crafted CI configurations to Alpine's GitLab instance on October 20 and 21, crashing worker processes eight times, and downloaded Alpine's GitLab container image, possibly to study it for another try. Later attempts on October 25 and 26 were blocked. "The attack came close to working," the project said.
What Alpine did next is the part worth copying. It found no evidence the attack succeeded but couldn't rule it out, so it treated the instance as compromised and rebuilt it from scratch. Its checks found the aports repository, packages and October 21 releases untouched. A CI server holds secrets and deploy keys and can push code to production, so "probably fine" isn't good enough there.
Patch self-managed GitLab now, then go through its logs for strange pipeline configs and unexplained worker crashes.
If your CI/CD pipeline also deploys your website, let's review how it's locked down before an attacker does it for you.
Source: BleepingComputer, DEV Community