GitLab RCE Vulnerability Fixed in October Update

GitLab disclosed a critical vulnerability (CVSS 10.0) that lets attackers run arbitrary code on self‑managed servers without authentication, affecting all versions since 7.0 released in 2014. The flaw stems from inadequate sanitisation when processing user‑controlled strings in the API, enabling malicious payloads to be injected into any endpoint that uses this component. This type of injection mirrors earlier high‑profile bugs such as Spring Data REST and Apache Struts before their mitigations around early 2017/mid‑2018. The issue required immediate patching regardless of existing security controls or network segmentation practices, as a CVSS score above nine indicates exploitability even by nontechnical actors given sufficient motivation. The fix adds proper input validation—a standard practice frequently overlooked during development cycles due to time constraints. ¹

On October 12, GitLab issued an update that covered only versions 19.2 and later; however, the new fixed release sits one patch above it and applies to every version back through 7.0. Consequently, administrators who applied the October 12 update were still vulnerable until they upgraded to the latest version released on October 21. The newer patch therefore closes the gap left by the earlier release and ensures full protection across the entire supported history of releases. ¹

The vulnerability’s scope—spanning twelve years of releases—means many organisations may have been exposed for years without awareness. Because the flaw allows unauthenticated remote code execution (RCE), attackers could compromise servers silently, potentially exfiltrating data or installing additional malware. Organizations using self‑managed instances should immediately verify whether they are running any affected version and apply the Oct 21 patch if not already done. ¹

Privacy experts echo these concerns, pointing out that improper JSON handling in APIs is a classic injection vector with devastating consequences given its wide reach. The CVSS score reflects both exploitability and impact: a perfect “Remote Code Execution” scenario requiring no credentials is one of the most critical findings imaginable. ¹