Remote code execution affecting GitLab CE/EE
GitLab Community Edition (CE) and Enterprise Edition (EE) are DevOps lifecycle management platforms enabling source code repository hosting, collaboration, and continuous integration/continuous deployment (CI/CD).
Description
Technical context and vulnerability details
This product is affected by a vulnerability labeled CVE-2026-110264, due to an integer overflow in the Onigmo regular expression compilation engine used by Ruby. Exploitation of this vulnerability would allow a malicious actor to access hosted sensitive data, including source code repositories and CI/CD secrets, and execute arbitrary code remotely on the vulnerable GitLab server. This vulnerability is classified critical with a severity score of 10 according to CVSS v3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Breach of confidentiality of data and source code repositories;
- Unauthorized modification or deletion of data;
- System and data integrity breach;
- Breach of data availability;
Affected systems
Products, components and targeted versions
- GitLab versions 7.0 to 18.11.x, prior to version 18.11.13;
- GitLab versions 19.0.x, prior to version 19.0.10;
- GitLab versions 19.1.x, prior to version 19.1.9;
- GitLab versions 19.2.x, prior to version 19.2.9;
- GitLab versions 19.3.x, prior to version 19.3.6;
- GitLab versions 19.4.x, prior to version 19.4.3;
- GitLab versions 19.5.x, prior to version 19.5.1;
RECOMMENDED ACTIONS:
- Update GitLab CE/EE releases to patched versions for their branch, or to a later supported version;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.