Body:

A CVSS 10.0 in GitLab’s CI/CD regex compiler — and the October 12 patch isn’t enough.

CVE-2026-97229 is an integer overflow (CWE-190) in Onigmo, Ruby’s regex engine. A crafted pattern in .gitlab-ci.yml triggers an overflow in the compiler’s program-size arithmetic, producing invalid bytecode that executes as the git OS account — the account that owns every repo, CI variable, and deployment key on the instance.

What you need to know:

Rapid7 published a working PoC the day after the patch

Alpine Linux was attacked 8 days later — worker crashed 8 times, attacker downloaded the container image to tune the exploit

CISA added it to KEV (federal deadline: Nov 1)

The Oct 12 releases (19.4.2/19.3.5/19.2.8) don’t cover CVE-2026-110264 — a second regex flaw in the same engine.…