GitLab's four CVEs got fixed twice: by Ruby, and by a free AI agent
Ruby patched the engine bugs behind GitLab's four critical CVEs on October 23 but declined to issue its own CVE IDs, leaving scanners blind to unpatched Ruby runtimes, and Cognition shipped a free agent skill that patches GitLab for anyone running Devin, Claude Code or Cursor. The question for GTLB holders: what is left to pay for.
Vincent Jiang · 3 min read
On October 23, 2026 Ruby core shipped 4.0.9, 3.4.12 and 3.3.13 with fixes for three bugs in Onigmo, the regular expression engine built into Ruby 2356. Those bugs sit underneath four critical flaws GitLab−0.26% — GitLab, down 0.26 percent today patched between September 23 and October 21, culminating in CVE-2026-110264, a CVSS 10.0 bug that lets an unauthenticated attacker run code on any GitLab release from 7.0 onward 2356.
The investors reading GTLB already know the stock: 56.28 dollars at the October 23 close, up about 50 percent this year, a cent below the average analyst target of 56.12 4. The security story is now the interesting one, because the fix left the building in two directions at once.
The blind spot is the business risk
GitLab did its part. It compiled the CVEs, shipped patched releases, backported as far as 18.11.13 and published detection rules for self-managed servers; GitLab.com and Dedicated are already patched 56. As of October 25 no exploitation is reported in GitLab or anywhere else, and none of the four CVEs sits in CISA's Known Exploited Vulnerabilities catalog 13.
Ruby did something stranger: it fixed the engine but declined to request CVE identifiers of its own, "at least for now" 127. Every CVE record and NVD product entry names only GitLab 1.
A scanner that matches CVE IDs to installed packages therefore finds no vulnerable Ruby anywhere, and Ruby applications outside GitLab that compile patterns from attacker-controlled text, through Regexp.new or a /#{input}/ literal, get no advisory to match against. Ruby itself says Regexp.timeout does not stop these bugs and that short patterns can trigger them, so the usual defenses do not apply 27.
The fix now comes from outside the vendor
On October 24 Cognition~$10B — Cognition, private, latest valuation ~$10B, maker of the Devin coding agent, published a free MIT-licensed skills package on GitHub+1.08% — GitHub, up 1.08 percent today with fix-gitlab-vuln among three entries 39. It inventories Dockerfiles, Helm charts and Terraform, stops at an approval gate, patches Omnibus, Docker and Helm installs of self-managed GitLab to 19.5.1 or a backport, and opens one pull request per repository 39. It runs in Devin, Claude Code, Codex, Cursor and other SKILL.md agents, and it carries no published fix-rate benchmark 3.
GitLab's four regex CVEs all sit at 9.9 or 10.0 severity
Data
| Value | |
|---|---|
| CVE-2026-89078 (Sep 23, auth) | 9.9/10 |
| CVE-2026-93577 (Sep 23, auth) | 9.9/10 |
| CVE-2026-97229 (Oct 12, unauth) | 10/10 |
| CVE-2026-110264 (Oct 21, unauth) | 10/10 |
That is a free agent repairing the flagship vulnerability of a paid security product, one day after the Ruby engine fix landed 23. One patch cycle proves nothing about a business model, and Cognition's own numbers, a reported 36 of 50 real-world vulnerabilities found on its July benchmark, come from the vendor's press release, not an audit 8. But the direction is readable: an outside agent priced at zero is now doing work GitLab's premium tiers exist to sell.
What to watch next
Ruby may still request CVE IDs, which would close the scanner gap and change how Ruby security is tracked 17. Whether exploitation moves from theory to practice will show up in CISA's KEV catalog 13. And whether self-managed enterprises keep paying premium prices for patch orchestration, or hand it to a free agent, is the metric that decides whether GTLB's 50 percent run survives its own security calendar 13. Dive into the linked coverage below for the insider-selling history this piece builds on.
Get Security by email, free
The breaches, flaws and security vendors AI is putting to the test. In our daily email, every weekday.
