Description
This module exploits an integer overflow in the Ruby regular expression compiler through GitLab's CI lint API. An attacker with credentials for a user who can push to a public project plants a crafted CI configuration and repository path. An unauthenticated CI lint request then compiles the expression and executes a command as the GitLab git account.
The module selects the native pcode and libruby layout for affected official GitLab CE and EE Docker images on Linux amd64. Each attempt allocates slightly more than 2 GiB and crashes a Puma worker after execution. GitLab 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are affected.
The official 19.3.4 package already contains the Ruby overflow fix and is not supported. Rebuilt packages and source installations may require different native layouts.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/multi/http/gitlab/cicd_regexp_rce_cve_2026_97229msf undefined(cicd_regexp_rce_cve_2026_97229) > show actions ...actions...msf undefined(cicd_regexp_rce_cve_2026_97229) > set ACTION < action-name >msf undefined(cicd_regexp_rce_cve_2026_97229) > show options ...show and set options...msf undefined(cicd_regexp_rce_cve_2026_97229) > runPrioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub