Source: cisa.gov
GitLab Community Edition and Enterprise Edition contain an integer overflow or wraparound vulnerability in the CI/CD regular expression compiler, rooted in the underlying Ruby/Onigmo regex engine. An unauthenticated attacker can exploit this flaw by submitting a specially crafted regular expression in a CI/CD configuration file, potentially leading to arbitrary code execution on the GitLab server. The vulnerability requires no authentication, making it particularly dangerous for publicly accessible GitLab instances. CISA has flagged this under BOD 26-04, indicating it is a priority for remediation. GitLab has released patch version 19.4.2 to address the issue. Other products using Ruby or the Onigmo regex library may also be affected by the same underlying flaw. Ruby's security team has published an advisory with additional details and fixes. Organizations are advised to apply the patch immediately and review forensic triage requirements per CISA guidance. The issue highlights the risks of insufficient input validation in CI/CD pipeline configurations.
