A severe vulnerability in GitLab, identified as CVE-2026-97229, has recently been exploited in an attack targeting Alpine Linux. This flaw, which has received the maximum CVSS score of 10 out of 10, originates from insufficient validation in Onigmo, the regular expression engine used by Ruby. GitLab explained in an advisory that the vulnerability could permit an unauthenticated user to execute arbitrary code on their server through a carefully crafted regular expression in a CI/CD configuration.

The attack against Alpine Linux’s GitLab instance occurred on October 20 and 21. Although the attack was unsuccessful, Alpine Linux took precautionary measures by completely rebuilding the instance. The organization confirmed that its aports repository and recent releases were not compromised. It continues to test the GitLab instance before making it publicly available and has reset all passwords due to automated login attempts using leaked passwords.

During the attack, the threat actor used a newly created account to send malicious CI configurations, resulting in the worker process crashing. While the attacker did not manage to execute code on the server, they did download the GitLab container image, indicating attempts to tailor the exploit specifically for this environment.

The vulnerability lies within Ruby itself, not GitLab, and Alpine Linux’s image uses standard Ruby. Therefore, simply updating to GitLab 19.3.6 does not mitigate the risk. Alpine Linux advises using Ruby version 3.3.13, 3.4.12, 4.0.9, or later to address the issue. In response, the US Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, instructing federal agencies to patch it promptly as per BOD 26-04.