AI analysis
GitLab remediated a critical flaw in GitLab Community Edition and Enterprise Edition in which insufficient validation of a regular expression in CI/CD configuration can let an unauthenticated remote attacker run arbitrary code on the GitLab server under certain conditions. The issue is triggered by a specially crafted regular expression supplied through CI/CD configuration and does not require a logged-in user. Successful exploitation yields full confidentiality, integrity, and availability impact on the server, with a changed scope (CVSS 3.1 10.0). It affects all 19.2 releases before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. It is not listed in CISA KEV and no public proof-of-concept is known.
What to do: Upgrade self-managed GitLab CE/EE to 19.2.8, 19.3.5, or 19.4.2 (or any later release on a supported line). Until patched, keep the instance off the public internet, restrict who can reach the web UI and API, and review recent CI/CD configuration changes for unexpected regular expressions.
Affected
| GitLab CE/EE | 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 |
Estimated exposure
largeon the order of 10,000–50,000 self-managed GitLab servers (estimate; only unpatched 19.2/19.3/19.4) — Public internet scans have long shown on the order of tens of thousands of reachable self-managed GitLab servers; only the three listed minor lines before the patched builds are vulnerable, so the exposed set is a fraction of that…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.