{"id":184003,"date":"2026-10-26T11:41:01","date_gmt":"2026-10-26T09:41:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/uyazvimost-v-ruby-ekspluatiruemaya-dlya-udalyonnogo-vypolneniya-koda-v-gitlab"},"modified":"2026-10-26T11:41:08","modified_gmt":"2026-10-26T09:41:08","slug":"ruby-vulnerability-exploited-for-remote-code-execution-in-gitlab","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/ruby-vulnerability-exploited-for-remote-code-execution-in-gitlab","title":{"rendered":"Vulnerabiliteti n\u00eb Ruby, i shfryt\u00ebzuar p\u00ebr ekzekutimin e kodit nga distanca n\u00eb GitLab","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Jan\u00eb publikuar versionet korrektuese t\u00eb gjuh\u00ebs s\u00eb programimit Ruby 3.3.13, 3.4.12 dhe 4.0.9, ku \u00ebsht\u00eb eliminuar nj\u00eb vulnerabilitet kritik (CVE-2026-110264) q\u00eb shkakton mbushje me numra t\u00eb plot\u00eb gjat\u00eb kompilimit t\u00eb shprehjeve t\u00eb rregullta t\u00eb dizajnuara posa\u00e7\u00ebrisht. Ky vulnerabilitet mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb sulmuar projekte t\u00eb shkruara n\u00eb gjuh\u00ebn Ruby q\u00eb p\u00ebrdorin t\u00eb dh\u00ebna t\u00eb jashtme n\u00eb shprehjet e rregullta. Nd\u00ebr t\u00eb tjera, \u00ebsht\u00eb konfirmuar mund\u00ebsia e shfryt\u00ebzimit t\u00eb k\u00ebtij vulnerabiliteti p\u00ebr ekzekutimin e kodit n\u00eb distanc\u00eb n\u00eb platform\u00ebn e zhvillimit t\u00eb p\u00ebrbashk\u00ebt GitLab. Problemi \u00ebsht\u00eb bllokuar gjithashtu n\u00eb p\u00ebrmir\u00ebsimet GitLab 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 dhe 18.11.13. Ky vulnerabilitet i \u00ebsht\u00eb caktuar niveli i rrezikshm\u00ebris\u00eb 10 nga 10. <\/p>\n
Vulnerabiliteti \u00ebsht\u00eb prezent n\u00eb motorin e shprehjeve t\u00eb rregullta Onigmo dhe \u00e7on n\u00eb mbipopullimin e identifikuesve t\u00eb brendsh\u00ebm gjat\u00eb kompaktimit t\u00eb nj\u00eb modeli me num\u00ebr t\u00eb madh p\u00ebrs\u00ebritjesh. Problemi shfaqet vet\u00ebm n\u00eb aplikacionet q\u00eb p\u00ebrdorin t\u00eb dh\u00ebna t\u00eb jashtme n\u00eb shprehjet e rregullta, t\u00eb p\u00ebrpunuara p\u00ebrmes metodave Regexp.new, Regexp.union dhe Regexp.compile ose literalet e formatit «\\\/#{input}\\\/». Kufizimi i madh\u00ebsis\u00eb s\u00eb shprehjes s\u00eb rregullt ose koh\u00ebs s\u00eb p\u00ebrpunimit p\u00ebrmes metod\u00ebs Regexp.timeout nuk e bllokon vulnerabilitetin, pasi p\u00ebr sulm mund t\u00eb p\u00ebrdoren modele t\u00eb shkurtra. <\/p>\n
N\u00eb GitLab, vulnerabiliteti mund t\u00eb shfryt\u00ebzohet nga nj\u00eb p\u00ebrdorues i paautorizuar p\u00ebr shkak t\u00eb z\u00ebvend\u00ebsimit n\u00eb shprehjen e rregullt me t\u00eb dh\u00ebna t\u00eb jashtme. Detajet e metod\u00ebs s\u00eb shfryt\u00ebzimit ende nuk jan\u00eb zbuluar (sipas rregullave t\u00eb GitLab, informacioni b\u00ebhet i disponuesh\u00ebm pas 30 dit\u00ebsh nga publikimi i p\u00ebrmir\u00ebsimit), megjithat\u00eb tashm\u00eb jan\u00eb regjistruar p\u00ebrpjekje p\u00ebr t\u00eb realizuar sulme ndaj p\u00ebrdoruesve t\u00eb GitLab. Sh znak\u00ebt e drejtp\u00ebrdrejta t\u00eb realizimit t\u00eb sulmit mund t\u00eb jen\u00eb nj\u00eb rritje e numrit t\u00eb mbarimeve aksidentale t\u00eb interpretuarit Ruby dhe rritja e gabimeve n\u00eb logjet e lidhura me skadimin e koh\u00ebs s\u00eb vizatimit t\u00eb faqes gjat\u00eb p\u00ebrpunimit t\u00eb org-filave.<\/p>\n
P\u00ebrve\u00e7 CVE-2026-110264, n\u00eb motorin e shprehjeve t\u00eb rregullta jan\u00eb eliminuar edhe tre vulnerabilitete t\u00eb tjera: CVE-2026-89078 (\u00e7lirimi i dyfisht\u00eb i memorjes n\u00eb rastin e pamund\u00ebsis\u00eb p\u00ebr t\u00eb analizuar modelin pas ndryshimit t\u00eb tij), CVE-2026-93577 dhe CVE-2026-97229 (mbushje me numra t\u00eb plot\u00eb gjat\u00eb llogaritjes s\u00eb madh\u00ebsis\u00eb s\u00eb modelit q\u00eb po komilohet). \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"