GitLab recently fixed a flaw in GitLab CE/EE that affected all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2, which allows unauthenticated users to execute arbitrary code on the GitLab server.

Through this blog, we break down what the max severity flaw in GitLab is about, its impact on organizations, and what organizations can do.

About the vulnerability

The vulnerability was originally discovered by a security researcher via GitLab’s HackerOne bug bounty program.

It is due to an integer overflow weakness in GitLab’s CI/CD Regular Expression Compiler, which can cause incorrect size calculations that lead to unsafe memory handling, allowing remote code execution.

What can attackers do with the flaw?

Attackers can exploit the flaw to:

• Remotely execute arbitrary code on vulnerable GitLab servers without authentication.
• Access sensitive information like source code, project files, or internal information.
• Tamper with CI/CD pipelines and inject malicious code into software releases.
• Threaten file integrity by modifying files and configurations.
• Disrupt GitLab deployment/development operations and services.

Official security guidance

Upgrade to the fixed GitLab versions:

• 19.2.8 or later
• 19.3.4 or later
• 19.4.2 or later

SharkStriker’s recommendations

• Upgrade affected GitLab instances immediately.
• Review CI/CD configurations and logs for suspicious activity.
• Restrict access to vulnerable instances until patching is completed.