Alpine Linux had upgraded to GitLab 19.3.6, but its environment remained vulnerable to CVE-2026-97229. Its container image used standard Ruby, where the vulnerability resided. The incident shows why an application version alone cannot establish that the vulnerable dependency has been fixed.

What happened

CVE-2026-97229 has a CVSS score of 10/10 and stems from insufficient regular expression validation in Onigmo, Ruby’s regular expression engine. GitLab said the flaw could allow unauthenticated users to execute arbitrary code on the server through specially crafted regular expressions in CI/CD configuration.

On October 20 and 21, a threat actor targeted Alpine Linux’s GitLab server. According to Alpine Linux, the attacker used newly registered accounts to submit specially crafted CI configuration, causing worker processes to crash. Those crashes were observed; server-side code execution remained uncertain.

The attack was reported as unsuccessful. Alpine Linux, however, said it had found no evidence that the attacker executed code on the server while acknowledging that it could not rule out that possibility.

Alpine Linux rebuilt the server from scratch. Its checks found no tampering with the aports repository, packages, or releases dated October 21. Those findings apply to the named assets and do not resolve the uncertainty about code execution.

TMGS recommendations

TMGS recommends that organizations operating their own GitLab deployments verify dependencies before closing patch tickets:

  • Inventory the deployed GitLab and Ruby versions and the container image’s origin.
  • Confirm that remediation addresses the vulnerable component, then verify the running environment after updating.
  • Assign responsibility for verification across application and infrastructure teams.
  • Preserve logs covering new accounts, CI configuration changes, and worker failures when suspicious activity appears.
  • Check source code and release package integrity when server compromise is suspected.

The acceptance criterion should be evidence that the vulnerable component has been addressed in the running system.

Read the full analysis on TMGS: https://tmgs.vn/tin-tuc/cap-nhat-gitlab-chua-du-neu-ruby-van-con-loi-i.e37b9fea-7b5b-43c8-8af6-cf78a9127596