Alpine Linux says an attacker tried to exploit CVE-2026-97229 against gitlab.alpinelinux.org on October 20 and 21 and came close to succeeding.
The flaw is a CVSS 10.0 bug in GitLab CI regex handling in Onigmo and enables remote code execution via a crafted CI file, per SecurityOnline.
Exploitation required only a newly registered account and a malicious CI configuration, with no local access, which Alpine confirmed when the account registered October 20 and crashed workers remotely.
The attack crashed GitLab workers eight times, with four attempts progressing past the initial regex crash before failing at the next stage, according to Alpine.
The attacker downloaded Alpine’s GitLab container image, suggesting exploit tuning to the exact build, Alpine said.
Alpine had upgraded to 19.3.4 on October 13 instead of the fixed 19.3.5 released October 12, and its October 22 upgrade to 19.3.6 still left the instance vulnerable.
The fix is a Ruby patch applied only in GitLab official packages, so Alpine’s image using standard Ruby stayed vulnerable until it republished 19.3.6 with Ruby 3.3.13 on October 27, Alpine said.
With no proof that code execution failed and with background job logs and the old container filesystem gone, Alpine treated the instance as compromised and rebuilt it from scratch by October 28.
Alpine said it verified every aports commit from October 20 to 22 against a developer clone and 45 builders and all packages built October 20 to 24 against git.alpinelinux.org.
That verification was run October 24 and Alpine said it is extending the same checks to October 27 while GitLab stays closed to public logins.
All passwords and secret keys were reset and Alpine told users to set a new password via Forgot your password when GitLab reopens and to change reused passwords elsewhere.
A successful exploit would leave no crash and no trace in web logs and Alpine had no outbound connection logging, so the rebuild trades certainty for downtime and commits Alpine to faster patching, outbound logging, longer retention beyond 14 days and signed release tags.
