GitLab CE and EE flaw allows remote code execution; exploited in the wild

What happened

GitLab has fixed a vulnerability in its Community Edition and Enterprise Edition that, under certain conditions, could let a remote attacker with no login run arbitrary code on a GitLab server. The problem involves regular expressions placed in a CI/CD configuration file, which the software did not validate thoroughly enough. The weakness is classified as an integer overflow or wraparound (CWE-190).

The flaw is being actively exploited, and CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-29. The CVE was published on 2026-10-13.

Who is affected

GitLab Community Edition and Enterprise Edition are affected in versions 19.2.0 up to but not including 19.2.8, 19.3.0 up to but not including 19.3.5, and 19.4.0 up to but not including 19.4.2.

The vulnerability record also lists the Ruby language runtime as affected: versions 3.3.0 before 3.3.13, 3.4.0 before 3.4.12, and 4.0.0 before 4.0.8.

How serious is it

This is as serious as it gets on the CVSS scale. The flaw carries a CVSS 3.1 base score of 10.0, the maximum. It can be triggered over the network, needs no credentials or user interaction, and can affect resources beyond the vulnerable component.

Attackers are already using it, and CISA lists it in its Known Exploited Vulnerabilities catalog with a remediation due date of 2026-11-01 for US federal agencies. The EPSS score, an estimate of how likely exploitation is, stands at 0.6522 as of 2026-11-09. Ransomware use has not been confirmed in the data available to us.

What you should do

1. 1Update GitLab Community Edition or Enterprise Edition to 19.2.8, 19.3.5 or 19.4.2, depending on your release line.
2. 2Update Ruby installations to 3.3.13, 3.4.12 or 4.0.8, depending on your release line.
3. 3Follow the GitLab vendor advisory and apply any mitigations it describes if you cannot update immediately.
4. 4Review each GitLab server's internet exposure and prioritize patching internet-facing instances.
5. 5Check affected servers for signs of compromise, as the flaw is being exploited in the wild.
6. 6If mitigations are unavailable, consider taking the product out of service as CISA's guidance suggests.

Quick facts