About Remote Code Execution - GitLab (CVE-2026-110264) vulnerability. GitLab is a platform for hosting code, collaborative software development, project management, and automating application testing and releases. GitLab CE is the free, open-source version of the platform, while GitLab EE is the enterprise version with additional features. Under certain conditions, the vulnerability in GitLab CE/EE allows an unauthenticated attacker to execute arbitrary code on the server. The vulnerability existed in GitLab for approximately 12 years and affected GitLab CE/EE versions 7.0 and later.

The vulnerability is caused by the following issue. GitLab uses the Ruby programming language to implement a significant part of its server-side logic. In particular, the platform's backend is built on Ruby on Rails, a web framework written in Ruby. Ruby also uses additional libraries and built-in components to perform various tasks. One of these is Onigmo, a regular expression engine responsible for searching and processing text based on predefined patterns. According to Censys research, the vulnerability is related to the processing of Org mode files with the .org extension. When converting these files to HTML, GitLab uses the org-ruby library, which processes user-defined keywords in documents, such as #+TODO:. An attacker can provide a specially crafted value for such a keyword, triggering an overflow in the Onigmo regular expression engine, resulting in memory corruption. Under certain conditions, this can lead to arbitrary code execution on the GitLab server. To exploit the vulnerability, an attacker needs to upload a specially crafted file to a public project. For example, if self-registration is enabled and users are allowed to create public projects, an attacker can register an account and create their own project. Once the file is uploaded, the vulnerable handler can be triggered simply by opening the file's preview page without authentication.

A compromised GitLab server may give an attacker access to project source code, access tokens, credentials, and other sensitive information. After gaining control of the server, an attacker may modify source code or build processes to inject malicious code into distributed applications. In addition, a compromised GitLab server can serve as a starting point for further attacks against the organization's internal infrastructure.

⚙️ The vulnerability has been fixed in versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. Infrastructure managed by GitLab itself, including GitLab.com and GitLab Dedicated, is already protected against this vulnerability. If GitLab was installed from unofficial packages and uses a custom Ruby version, updating GitLab alone is not sufficient. This applies, for example, to custom-built GitLab versions and installations using custom container images. In such cases, Ruby must also be updated separately to version 3.3.13, 3.4.12, or 4.0.9 or later. This is because the fix for CVE-2026-110264 was implemented directly in Ruby, not in the GitLab code. The fix is already included in the official GitLab Linux packages and container images.

The GitLab security team has released two detection rules to identify potential attacks against self-hosted GitLab instances: Onigmo native worker crash and Org mode render error burst.

🛠 PoC exploits have been available on GitHub since October 22.

👾 There is currently no evidence that the vulnerability has been exploited in the wild.

🌐 According to Shadowserver, more than 10,000 vulnerable GitLab instances are exposed to the Internet.