---
title: "Discussion on \"A CVSS 10.0 Bug Sat Inside GitLab for 12 Years. It Lived in the Regex Engine.\" | Hashnode"
description: "Discussion on \"A CVSS 10.0 Bug Sat Inside GitLab for 12 Years. It Lived in the Regex Engine.\". An out-of-band patch fixed an unauthenticated RCE in a library most developers never heard of — and the researcher who found it is just getting started."
url: "https://hashnode.com/posts/a-cvss-10-0-bug-sat-inside-gitlab-for-12-years-it-lived-in-the-regex-engine/6ad9b89b476a7f24ac3d4bc6"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [A CVSS 10.0 Bug Sat Inside GitLab for 12 Years. It Lived in the Regex Engine.](https://nulltrace.hashnode.dev/a-cvss-10-0-bug-sat-inside-gitlab-for-12-years-it-lived-in-the-regex-engine?utm_source=hashnode&utm_medium=feed)

An out-of-band patch fixed an unauthenticated RCE in a library most developers never heard of — and the researcher who found it is just getting started.

Oct 22 · 4 min read · nulltrace.hashnode.dev  
Read the article

-   [#cybersecurity](https://hashnode.com/tag/cybersecurity)
-   [#vulnerabilities](https://hashnode.com/tag/vulnerabilities)
-   [#gitlab](https://hashnode.com/tag/gitlab)
-   [#devsecops](https://hashnode.com/tag/devsecops)
-   [#infosec](https://hashnode.com/tag/infosec)

## Written by

[Cyber Knight](https://hashnode.com/@cyberknight2479)

@cyberknight2479

  
[View profile](https://hashnode.com/@cyberknight2479)

## Responses 1

Markdown supported · ⌘↵ to post

[Damiano Bianda](https://hashnode.com/@damianobianda)

[Oct 30](https://hashnode.com/posts/a-cvss-10-0-bug-sat-inside-gitlab-for-12-years-it-lived-in-the-regex-engine/6ad9b89b476a7f24ac3d4bc6/comment/6ae46f7c947fdad2e30cc78c)

One operational detail worth adding: GitLab's fix shipped as patches to the Ruby bundled in its own packages and images, so anyone running GitLab on a distribution or self-built Ruby stays vulnerable even on the latest GitLab version. Alpine Linux's public instance got caught exactly this way in October - they upgraded GitLab twice and remained exploitable until they pulled a Ruby with the fix. If you run self-managed, check the interpreter (3.3.13 / 3.4.12 / 4.0.9+), not just the GitLab version string. CISA put it in KEV with a November 1 due date for federal agencies, so the window is short.