Summary
GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
- Vendor
- GitLab
- Product
- Community Edition and Enterprise Edition
- Added to KEV
- Oct 29, 2026
- Remediation due
- Nov 1, 2026 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-190
- EPSS
- 65.2% as of Nov 10
In the news · last mention Oct 19
References