CVSS
9.9CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.44%Chance of exploitation activity in the next 30 days, higher than 37% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Vendor and government advisories 1
Vendors that say their products are affected, and agencies that issued alerts. Check each for the fixed release of the product you run.
Reports 6
2 outlets mention it. Reports are not confirmation; each links to its source.
- @newssecia.bsky.social: 🤖 Ruby 4.0.9, 3.4.12, 3.3.13 fix Onigmo memory bugs behind GitLab RCEs CVE-2026-89078/93577/97229/110264. Affects apps compiling attacker-controlled patterns. https://www.ruby-langBluesky: CVE posts, 24 Oct 2026
- @getpokemon7.bsky.social: 「GitLab」がセキュリティアップデートを公開 - 深刻な脆弱性にも対処 GitLabは、同社の開発プラットフォーム「GitLab」に脆弱性が見つかったとしてアップデートをリリースした。深刻な脆弱性にも対処している。 ... 重要度を見ると、4段階評価でもっとも高い「クリティカル（Critical）」とされる脆弱性は2件。「CVE-2026-89078」はBluesky: CVE posts, 23 Oct 2026
- Ruby 3.3.13 ReleasedRuby, 23 Oct 2026
- Ruby 3.4.12 ReleasedRuby, 23 Oct 2026
- Ruby 4.0.9 ReleasedRuby, 23 Oct 2026
- Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264Ruby, 23 Oct 2026
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a specially crafted regular expression in a CI/CD configuration.
Text from CVE List
Affected versions 3
- GitLabaffected: 19.2 before 19.2.7CVE List
- GitLabaffected: 19.3 before 19.3.3CVE List
- GitLabaffected: 19.4 before 19.4.1CVE List