GitLab CVE-2026-97229 CI regex overflow followed by server-side shell spawn

ills3c Intel&Coffee@Ills3C

•updated today•0•0•5

Detects observable consequences of remote code execution on a GitLab server (CVE-2026-97229), specifically where GitLab application services (such as Puma, Sidekiq, Ruby, GitLab Rails, or GitLab Workhorse) spawn a shell or interpreter with suspicious command-line parameters or external network utilities.