{"type":"bundle","id":"bundle--c7ad0b48-b457-50ea-b072-710412bb9335","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--5eae22fa-e000-5ce1-8f35-aa17f128d7fe","created":"2026-10-21T20:22:43.183Z","modified":"2026-10-21T20:22:43.183Z","name":"GitLab servers taken over with no login through a crafted Org-mode file, even after the Oct 12 patch (CVE-2026-110264)","description":"CVE-2026-110264 (CVSS 10.0, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) is an integer overflow in Onigmo, the Ruby regular expression engine bundled with GitLab CE/EE, that can let an unauthenticated user execute arbitrary code on a self-managed GitLab server. GitLab's detection write-ups describe the path: the org-ruby gem that renders .org files interpolates a raw #+TODO: keyword into Regexp.new, and a keyword with more than 32,767 generic repeats wraps Onigmo's signed 16-bit repeat ID, causing an out-of-bounds write at match time that GitLab says can be turned into a system() call as the git user. Every version from 7.0 is affected. GitLab fixed it on 2026-10-21 in 19.5.1, 19.4.3 and 19.3.6 and backported the fix to 19.2.9, 19.1.9, 19.0.10 and 18.11.13. The Oct 12 fixes for CVE-2026-97229 (19.4.2, 19.3.5, 19.2.8) are below the new fixed versions, so those servers are exposed again. Reported by joaxcar through HackerOne.","aliases":["CVE-2026-110264","GitLab Onigmo regex RCE","GitLab Org-mode RCE","GitLab org-ruby TODO keyword overflow","GitLab 19.5.1 critical patch"],"first_seen":"2026-10-21T00:00:00Z","last_seen":"2026-10-21T20:15:10Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/"},{"source_name":"GitLab TLDR detection: Org mode render error burst (CVE-2026-110264)","url":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md"},{"source_name":"GitLab TLDR detection: Onigmo native worker crash","url":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md"},{"source_name":"The Hacker News: Critical GitLab flaw (CVSS 10.0) across 12 years of releases","url":"https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html"},{"source_name":"HOL blog: GitLab CVE-2026-110264 operator write-up","url":"https://hol.org/blog/cve-2026-110264-gitlab-onigmo-regex-unauthenticated-rce"}]}]}