— Ingenious AI security check.
Don’t panic, verify: check your GitLab version against the advisory’s affected range, confirm whether the vulnerable component is exposed, then patch in a maintenance window. This page’s checker gives you the version verdict in seconds — the advisory tells you whether that verdict means real exposure.
A maximum-severity flaw in GitLab's CI/CD regular expression compiler lets an attacker run code on your GitLab server — no login required on instances with open sign-ups. The patch shipped October 12; a working proof-of-concept went public October 13; Censys counts 25,766 internet-facing hosts still on vulnerable versions. This free CVE check tool tells you if you're at risk. No signup, nothing installed.
Check your GitLab version — on the host running GitLab:
sudo gitlab-rake gitlab:env:info | grep "GitLab version"
Check whether open sign-ups make it worse — the exploit needs a malicious CI config committed to a repo before it can be triggered. If anyone on the internet can register on your instance, that barrier is gone:
Admin area → Settings → General → Sign-up restrictions — or on the host:
grep "signup_enabled" /etc/gitlab/gitlab.rb
Check for signs of past compromise — the exploit runs inside a GitLab application worker, so a successful hit can read CI/CD variables, secrets, and the database. Hunt for unauthenticated hits on the CI lint endpoint since October 12:
grep "ci/lint" /var/log/gitlab/gitlab-rails/production.log
Also review .gitlab-ci.yml commits from the last two weeks for complex regex you didn't authorize, plus unexpected runner registrations or new admin users. Log review is indicative, not conclusive — patching and compromise-checking are two separate jobs.
gitlab-secrets.json. Patching doesn't un-read secrets..gitlab-ci.yml looks innocent until it runs.This page checked one CVE. Vibe-Code Audit scans your repositories for malicious code, injected configs, and leaked secrets — the artifacts this attack leaves behind.
Drop a live version-checker into your blog, docs, or forum post — three lines of HTML.
Get the embed codeOn your GitLab host run: sudo gitlab-rake gitlab:env:info | grep "GitLab version". Versions 19.2.0-19.2.7, 19.3.0-19.3.4, and 19.4.0-19.4.1 are vulnerable to unauthenticated remote code execution. Upgrade to 19.2.8, 19.3.5, or 19.4.2 (or newer). The free 30-second self-test on this page walks through the exact checks.
Almost. The exploit needs a malicious CI configuration committed to a repository first, then the CI lint endpoint is triggered without credentials. On GitLab instances with open self-registration, any internet user can plant that config — so treat it as fully unauthenticated. With sign-ups restricted, an attacker still only needs one low-privilege account.
Upgrade to 19.2.8 / 19.3.5 / 19.4.2 immediately, outside your normal patch cycle. Rotate everything the application worker could have read: CI/CD variables (masked and protected first), runner registration tokens, personal access tokens, and the Rails secret. Review recent .gitlab-ci.yml commits for regex-heavy changes nobody on your team made, and turn off open registration unless you truly need it.
A CVE checker is a free tool that tells you whether your software is affected by a published CVE — a publicly known cybersecurity vulnerability. It compares your version or configuration against the official advisory and gives you a patched, vulnerable, or unknown verdict in about 30 seconds.
Find your exact version number, then compare it against the vendor's security advisory or the NVD entry for the CVE. The fastest way is a CVE checker built for that product: paste your version and get an instant verdict against the published version tables.
You are affected when you run a vulnerable version and the vulnerable component is reachable or enabled — for example, open sign-ups, an exposed management port, or a vulnerable app installed. A CVE checker gives you the version verdict in seconds; the advisory's conditions tell you whether that verdict means real exposure.
Update — October 22, 2026: A successor flaw, CVE-2026-110264 — also CVSS 10.0, in the same Onigmo regex compiler, reported by the same researcher — reaches back to GitLab 7.0 and puts October 12 patchers back in range: the builds this page recommends (19.2.8 / 19.3.5 / 19.4.2) each sit one patch below the new fixed releases (19.2.9 / 19.3.6 / 19.4.3). Patched for CVE-2026-97229? You need one more upgrade — run the CVE-2026-110264 version check.