GitLab patches a second CVSS 10.0 RCE in nine days
CVE-2026-110264 is an unauthenticated code execution bug in the Onigmo regex engine, reached through Org-mode file previews. It reaches back to 2014 and catches servers already patched for the 12 October flaw.
GitLab shipped an emergency patch on 21 October for CVE-2026-110264, a maximum-severity, CVSS 10.0 bug that lets an unauthenticated attacker run code on a self-managed server. It is a separate flaw from the CVSS 10.0 issue GitLab patched just nine days earlier.
This one sits in Onigmo, the regex engine Ruby ships with, reached through the org-ruby gem GitLab uses to preview Org-mode files. Rendering a .org file passes the content of its #+TODO: keywords straight into Regexp.new, and a crafted regular expression triggers an integer overflow. Because the bug lives in that dependency rather than the CI/CD compiler fixed on 12 October, it still catches instances that applied that earlier patch. The flaw reaches back to GitLab 7.0, from 2014. Fixed versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. The same release also fixes a CVSS 8.2 SAML/LDAP account-takeover bug and a CVSS 7.5 OAuth cache-poisoning flaw.
Why it matters: GitLab reports more than 50 million registered users, and self-managed instances are common in banks and other regulated shops that can’t just move to SaaS. If you upgraded on 12 October and assumed you were covered, you were not: this is a different hole in a different component, and it needs its own upgrade.
The caveat: GitLab says it has no evidence of active exploitation yet, though a proof-of-concept exploit is already public, so treat this as urgent rather than confirmed under attack.