GitLab CE/EE Unauthenticated RCE via Integer Overflow in CI/CD Regular Expression Compiler

#!/bin/bash
# check_cve_2026_97229.sh — Detect CVE-2026-97229 (GitLab CI/CD regex RCE)
# Run on the target GitLab host as root.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

VERSION_FILE="/opt/gitlab/embedded/service/gitlab-rails/VERSION"

if [[ ! -f "$VERSION_FILE" ]]; then
  # Try Docker / Kubernetes path
  VERSION_FILE="/opt/gitlab/embedded/service/gitlab-rails/VERSION"
  if command -v gitlab-rake &>/dev/null; then
    RAW_VERSION=$(gitlab-rake gitlab:env:info 2>/dev/null | grep -oP 'GitLab:\s+\K[0-9]+\.[0-9]+\.[0-9]+')
  else
    echo "UNKNOWN — cannot determine GitLab version. Is this a GitLab host?"
    exit 2
  fi
else
  RAW_VERSION=$(cat "$VERSION_FILE" 2>/dev/null)
fi

if [[ -z "${RAW_VERSION:-}" ]]; then
  echo "UNKNOWN — could not read GitLab version."
  exit 2
fi

echo "Detected GitLab version: $RAW_VERSION"

# Parse major.minor.patch
IFS='.' read -r MAJOR MINOR PATCH <<< "$RAW_VERSION"

# Only versions 19.2.x through 19.4.x are affected
if (( MAJOR != 19 )); then
  echo "PATCHED — major version $MAJOR is outside the affected range (19.2–19.4)."
  exit 0
fi

if (( MINOR < 2 )); then
  echo "PATCHED — version $RAW_VERSION predates the vulnerable code (introduced in 19.2.0)."
  exit 0
fi

if (( MINOR > 4 )); then
  echo "PATCHED — version $RAW_VERSION is newer than all affected branches."
  exit 0
fi

# Check each affected branch
case "$MINOR" in
  2)
    if (( PATCH >= 8 )); then
      echo "PATCHED — $RAW_VERSION includes the fix (19.2.8+)."
      exit 0
    else
      echo "VULNERABLE — $RAW_VERSION is affected. Upgrade to 19.2.8 or later."
      exit 1
    fi
    ;;
  3)
    if (( PATCH >= 5 )); then
      echo "PATCHED — $RAW_VERSION includes the fix (19.3.5+)."
      exit 0
    else
      echo "VULNERABLE — $RAW_VERSION is affected. Upgrade to 19.3.5 or later."
      exit 1
    fi
    ;;
  4)
    if (( PATCH >= 2 )); then
      echo "PATCHED — $RAW_VERSION includes the fix (19.4.2+)."
      exit 0
    else
      echo "VULNERABLE — $RAW_VERSION is affected. Upgrade to 19.4.2 or later."
      exit 1
    fi
    ;;
  *)
    echo "UNKNOWN — version $RAW_VERSION is on an unrecognized minor branch."
    exit 2
    ;;
esac