Alpine Linux says someone tried to exploit CVE-2026-97229 (CVSS 10.0) on its own GitLab server a week after GitLab shipped the fix. The bug allows code execution through a crafted regex in a CI config.
The gotcha
GitLab’s fix is actually a patch to the Ruby it bundles in its own packages and images. Alpine’s image used standard Ruby, so upgrading to GitLab 19.3.6 on Oct 22 didn’t close the hole. If you run GitLab on your own Ruby (from source or a custom container), you also need Ruby 3.3.13, 3.4.12, 4.0.9 or later. Users of the alpinelinux/gitlab image need to pull 19.3.6 again.
Alpine found no proof the attack worked but rebuilt the server and reset every password. It says packages built Oct 20 to 24 were verified against records outside GitLab.
My take
Hats off to Alpine for being open about it. If you self-host GitLab, check your Ruby version, not just your GitLab version.
God Bless, and Needs Garlic!
