GitLab CI/CD Regex Flaw Allows Remote Code Execution

GitLab has remediated an issue in GitLab CE/EE that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

The vulnerability affects the following versions:

• All versions from 19.2 before 19.2.8
• All versions from 19.3 before 19.3.5
• All versions from 19.4 before 19.4.2

Under certain conditions, an unauthenticated user could exploit this flaw to achieve code execution on the server.