GitLab’s October 21 patch release fixes CVE-2026-110264: rendering a crafted .org file lets an unauthenticated attacker run code on the server, CVSS 10.0.
Ikesan’s analysis traces it to Onigmo, Ruby’s regex engine.
The #+TODO: keywords of an Org mode file go unescaped into Regexp.new, and an integer overflow while compiling that pattern ends with commands running as the git user.
Every self-managed CE/EE release since 7.0 is affected; GitLab.com and Dedicated are already patched.
The fixed versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. 18.10 and older get no fix, so those instances have to follow the upgrade path to 18.11.13 or later. If you just installed the October 12 releases (19.4.2, 19.3.5, 19.2.8), congratulations, you get to do it again. The bug is the third GitLab regex find from joaxcar via HackerOne, and GCVE already links a proof-of-concept repository, so this one shouldn’t wait for the next maintenance window.