PoC Exploit Released for Critical GitLab RCE Vulnerability (CVE-2026-97229)

What happened?

A public proof-of-concept (PoC) for CVE-2026-97229 published by researcher Jonah Burgess shows how a flaw in GitLab’s CI/CD regular-expression compiler could be used to run commands on a vulnerable server. GitLab rates the issue Critical with a CVSS score of 10.0. The exploit code is publicly available, raising the risk for organizations that have not yet installed the security updates. The PoC targets GitLab Community Edition and Enterprise Edition. Its author reports testing the included exploit layout against the official Linux amd64 GitLab CE 19.4.1 image.