GitLab has addressed a set of critical vulnerabilities whose root cause lies in the Ruby programming language rather than in the platform code itself. The most severe issue, tracked as CVE-2026-97229, received the maximum CVSSv3.1 base score of 10.0 and has already been observed being exploited in the wild.
The flaw originates in the way Ruby's regular-expression engine Onigmo processes patterns contained inside GitLab CI/CD configuration files. An integer overflow during regex compilation allows an attacker to trigger memory corruption that can lead to remote code execution.
GitLab published fixes on October 8, 2026, in versions 19.4.2, 19.3.5, and 19.2.8. Three additional vulnerabilities share the same underlying defect in Onigmo:
- CVE-2026-89078 – double-free condition during regex parsing
- CVE-2026-93577 and CVE-2026-110264 – integer overflows at compile time
The Ruby core team issued a coordinated advisory on October 23, 2026, detailing the fixes required in the language runtime. Because the vulnerabilities reside in a shared dependency, any application or service that relies on the affected Ruby versions and processes untrusted regular expressions may also be at risk.
Security researchers recommend that organizations using GitLab apply the patches without delay and review any custom Ruby deployments that incorporate similar regex handling logic.
