GitLab patches critical security flaw

GitLab has released several updated versions of its software—19.4.2, 19.3.5, and 19.2.8—to fix a critical security vulnerability. This flaw, rated the highest possible severity (10 out of 10), allows an attacker without an account to run malicious code on a server by inserting a harmful regular expression into a CI/CD configuration.

Vulnerability details remain unclear

GitLab explains that the vulnerability can be exploited "under certain conditions," but it has not provided specifics about those conditions. The company also does not clarify how an unauthenticated attacker might get their forged CI/CD configuration processed by a server instance. Technical details about the flaw, including an integer overflow in the regex compiler and weak validation of expressions, will not be disclosed for about 90 days, following standard security practices.

Recent pattern of similar vulnerabilities

This is the latest in a series of high-severity vulnerabilities affecting GitLab’s software in recent weeks. Similar issues were reported in late September, including two other flaws rated 9.9 out of 10. These were also discovered by the same researcher, joaxcar, and required an account to exploit. Another vulnerability, rated 10 out of 10, allowed attackers to read files on the server without needing an account.

Many versions are affected

Self-hosted GitLab instances running versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are vulnerable. This includes the version 19.4.1 released at the end of September, which was not sufficient to address the issue. GitLab.com itself is already updated, and users of dedicated server clients are not at risk. However, no temporary fixes or workarounds are provided—only an update is recommended.

Patching may cause downtime

For users running single-node GitLab instances, updating to the latest version may result in downtime. This is because the patch includes database migrations that require a server reboot. Users are advised to plan for potential service interruptions when applying the update.