TOPIC
CVE-2026-97229 identity, active exploitation, Ruby/Onigmo root cause, exploit preconditions, affected/fixed state, custom-runtime patch provenance, CI/CD impact, detection/triage, victim/campaign boundaries and defensive remediation.
1
5
4
5
4
NEW — GitLab critical RCE + Oct-29 KEV + Alpine real exploitation attempts + independent Rapid7 RCE reproduction verified. Alpine demonstrates version-only false remediation for custom Ruby packaging. Successful Alpine compromise, universal no-write exploitability, victim scale and attribution remain gated.
VULNERABILITY_EXPLOITATION_RESEARCH_TOPIC
—
—
—
CVE-2026-97229 is a real operational RCE risk against affected self-managed GitLab, with authoritative known-exploitation status and independently reproduced code execution.
Confirmed-success victim IR and broader exploitation telemetry.
Custom GitLab deployments that substitute their own Ruby can remain vulnerable after a GitLab version upgrade unless Ruby/Onigmo is patched.
Prevalence/telemetry of custom runtime builds.
Successful GitLab RCE can expose CI/CD secrets/repos and downstream delivery trust, but Alpine did not confirm theft/tampering.
مرجع SSOT مسجل، لكن الرابط الداخلي مخفي حتى تفعيل حماية Admin.
Related Topics
Related Domains
الإجمالي: 5 Evidence
GitLab states CVE-2026-97229 can under certain conditions allow an unauthenticated user to execute arbitrary code via crafted CI/CD regex; affected self-managed 19.2<19.2.8, 19.3<19.3.5, 19.4<19.4.2; GitLab.com/Dedicated patched; detections released.
لا يثبت: Victim count, campaign scale, attacker identity or identical exploit prerequisites across all configurations.
فتح Run المصدرCISA added CVE-2026-97229 to KEV on 2026-10-29, establishing authoritative known-exploitation status and urgent remediation/forensic relevance.
لا يثبت: Raw incidents, successful victim count, actor identity, campaign scale or ransomware use.
فتح Run المصدرAlpine documents Oct-20/21 crafted-CI exploitation attempts: eight worker crashes, four partial exploit progressions and attacker download of the GitLab image. No evidence of attacker code execution was found, but Alpine could not rule it out due missing telemetry. Its GitLab 19.3.6 upgrade left the custom image vulnerable because standard Ruby lacked GitLab's bundled patch.
لا يثبت: Successful code execution, data theft, package/release tampering, signing-key exposure or broad campaign scale.
فتح Run المصدرRuby 3.3.13, 3.4.12 and 4.0.9 contain regexp compilation fixes for underlying Ruby/Onigmo bugs used by GitLab CVE-2026-97229 and related GitLab CVEs.
لا يثبت: Exploitation prevalence, GitLab compromise or universal Ruby application exploitability.
فتح Run المصدرRapid7 independently reproduced arbitrary command execution on unpatched official GitLab 19.4.1 CE and confirmed patched 19.4.2 blocked its disclosed chain. The public route requires attacker-controlled malicious CI content before an unauthenticated CI-lint trigger; Rapid7 provides worker-crash/502, CI-lint, regexp/path and memory/process detection guidance.
لا يثبت: In-the-wild successful compromise, victim scale, actor identity or equivalence to the undisclosed original route.
فتح Run المصدرIndependent downstream-compromise case evidence.
CVE-2026-97229 is universally precondition-free unauthenticated RCE across affected configurations.
Original/private route or independent no-write reproduction.
Known exploitation represents one attributable broad campaign with measurable victim scale or ransomware use.
Independent actor-linked infrastructure, victim clustering or authoritative attribution.
No reliable public count of successfully exploited GitLab victims, attack volume or current compromised population for CVE-2026-97229.
CISA raw evidence, multi-victim IR/provider telemetry or authoritative victim reporting.
Exact original private exploit route and whether it removes the content-write prerequisite in Rapid7's public chain remain undisclosed.
Original HackerOne/vendor technical disclosure or independent no-write-precondition reproduction.
No reliable denominator exists for custom GitLab deployments upgraded at the app layer but still using vulnerable Ruby/Onigmo.
Version-aware GitLab+Ruby telemetry or large-sample authenticated inventory.
Actor identity, infrastructure, victim clustering, campaign breadth and ransomware relationship remain unproven.
Independent actor-linked infrastructure, repeated incident artifacts or authoritative attribution.
RUNTIME_PATCH_PROVENANCE
ATTRIBUTION_CAMPAIGN
فتح Run