--- title: "GitLab's four CVEs got fixed twice: by Ruby, and by a free AI agent" description: "Ruby patched the engine bugs behind GitLab's four critical CVEs on October 23 but declined to issue its own CVE IDs, leaving scanners blind to unpatched Ruby runtimes, and Cognition shipped a free agent skill that patches GitLab for anyone running Devin, Claude Code or Cursor. The question for GTLB holders: what is left to pay for." publisher: "The Inference" section: "Security" published: 2026-10-26T15:04:12.904Z modified: 2026-10-26T15:04:12.904Z canonical: https://theinference.org/article/gitlab-s-four-cves-got-fixed-twice-by-ruby-and-by-a-free-ai-agent language: en keywords: "GitLab, Cybersecurity, AI Agents, CVE, Open Source" --- # GitLab's four CVEs got fixed twice: by Ruby, and by a free AI agent > Ruby patched the engine bugs behind GitLab's four critical CVEs on October 23 but declined to issue its own CVE IDs, leaving scanners blind to unpatched Ruby runtimes, and Cognition shipped a free agent skill that patches GitLab for anyone running Devin, Claude Code or Cursor. The question for GTLB holders: what is left to pay for. On October 23, 2026 Ruby core shipped 4.0.9, 3.4.12 and 3.3.13 with fixes for three bugs in Onigmo, the regular expression engine built into Ruby [2][3][5][6]. Those bugs sit underneath four critical flaws [GitLab](https://theinference.org/markets/companies/gitlab) patched between September 23 and October 21, culminating in CVE-2026-110264, a CVSS 10.0 bug that lets an unauthenticated attacker run code on any GitLab release from 7.0 onward [2][3][5][6]. The investors reading GTLB already know the stock: 56.28 dollars at the October 23 close, up about 50 percent this year, a cent below the average analyst target of 56.12 [4]. The security story is now the interesting one, because the fix left the building in two directions at once. ## The blind spot is the business risk GitLab did its part. It compiled the CVEs, [shipped patched releases](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/), backported as far as 18.11.13 and published detection rules for self-managed servers; GitLab.com and Dedicated are already patched [5][6]. As of October 25 no exploitation is reported in GitLab or anywhere else, and none of the four CVEs sits in CISA's Known Exploited Vulnerabilities catalog [1][3]. Ruby did something stranger: it fixed the engine but [declined to request CVE identifiers of its own](https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/), "at least for now" [1][2][7]. Every CVE record and NVD product entry names only GitLab [1]. A scanner that matches CVE IDs to installed packages therefore finds no vulnerable Ruby anywhere, and Ruby applications outside GitLab that compile patterns from attacker-controlled text, through Regexp.new or a /#{input}/ literal, get no advisory to match against. Ruby itself says Regexp.timeout does not stop these bugs and that short patterns can trigger them, so the usual defenses do not apply [2][7]. ## The fix now comes from outside the vendor On October 24 [Cognition](https://theinference.org/markets/companies/cognition), maker of the Devin coding agent, [published a free MIT-licensed skills package](https://github.com/CognitionAI/devin-vuln-fixes) on [GitHub](https://theinference.org/markets/companies/microsoft) with fix-gitlab-vuln among three entries [3][9]. It inventories Dockerfiles, Helm charts and Terraform, stops at an approval gate, patches Omnibus, Docker and Helm installs of self-managed GitLab to 19.5.1 or a backport, and opens one pull request per repository [3][9]. It runs in Devin, Claude Code, Codex, Cursor and other SKILL.md agents, and it carries no published fix-rate benchmark [3]. *Chart: **GitLab's four regex CVEs all sit at 9.9 or 10.0 severity** Bars showing the four GitLab CVEs and their CVSS 3.1 scores.* *GitLab's four regex CVEs all sit at 9.9 or 10.0 severity [1][5][6]* That is a free agent repairing the flagship vulnerability of a paid security product, one day after the Ruby engine fix landed [2][3]. One patch cycle proves nothing about a business model, and Cognition's own numbers, a reported [36 of 50 real-world vulnerabilities](https://www.aol.com/articles/cognition-launches-devin-security-swarm-130000000.html) found on its July benchmark, come from the vendor's press release, not an audit [8]. But the direction is readable: an outside agent priced at zero is now doing work GitLab's premium tiers exist to sell. ## What to watch next Ruby may still request CVE IDs, which would close the scanner gap and change how Ruby security is tracked [1][7]. Whether exploitation moves from theory to practice will show up in CISA's KEV catalog [1][3]. And whether self-managed enterprises keep paying premium prices for patch orchestration, or hand it to a free agent, is the metric that decides whether GTLB's 50 percent run survives its own security calendar [1][3]. Dive into the linked coverage below for [the insider-selling history](https://theinference.org/article/gitlab-sold-the-ai-factory-story-while-insiders-sold-103-8-million-of-the-stock) this piece builds on. ## Takeaway Ruby fixed the Onigmo engine bugs under GitLab's four critical CVEs without CVE IDs of its own, and Cognition released a free agent that patches GitLab for anyone, sharpening the question of what premium security subscriptions are still for. ## Sources 1. [Rescana CVE Analysis Center, Ruby Fixes the Onigmo Regexp Bugs Behind GitLab's Four CVEs, 25 October 2026](https://www.rescana.com/post/ruby-onigmo-regexp-fixes-gitlab-cves-october-2026) 2. [The Hacker News, Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws, 23 October 2026](https://thehackernews.com/2026/10/ruby-fixes-three-regex-engine-bugs.html) 3. [MarkTechPost, Cognition Open-Sources an Agent Plugin that Helps Secure Systems against Recent Cybersecurity Threats, 24 October 2026](https://www.marktechpost.com/2026/10/24/cognition-devin-vulnerability-fixes-plugin-php2shell-nodejs-gitlab/) 4. [MarketScreener / MT Newswires, BofA Securities Adjusts Price Target on Gitlab to $64 From $54, Maintains Neutral Rating, 23 October 2026](https://www.marketscreener.com/news/bofa-securities-adjusts-price-target-on-gitlab-to-64-from-54-maintains-neutral-rating-ce785cdfda8cf52d) 5. [GitLab Docs, Critical Patch Release 19.4.1, 19.3.3, 19.2.7, 23 September 2026](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/) 6. [GitLab Docs, Critical Patch Release 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13, 21 October 2026](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/) 7. [Ruby News, Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264, 23 October 2026](https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/) 8. [PR Newswire via AOL, Cognition Launches Devin Security Swarm to Tackle the Vulnerability Backlog, 1 July 2026](https://www.aol.com/articles/cognition-launches-devin-security-swarm-130000000.html) 9. [GitHub, CognitionAI/devin-vuln-fixes repository, README, accessed 26 October 2026](https://github.com/CognitionAI/devin-vuln-fixes) --- GitLab's four CVEs got fixed twice: by Ruby, and by a free AI agent — The Inference. Canonical: https://theinference.org/article/gitlab-s-four-cves-got-fixed-twice-by-ruby-and-by-a-free-ai-agent