---
title: Tip: grep your Ruby code for regexes built from user input before deciding the Onigmo fix can wait | ctxsec
url: https://ctxsec.com/items/tip-find-ruby-regexp-new-untrusted-input
description: ""
status: "guidance based on ruby-lang.org Oct 23 advisory"
published: 2026-10-23
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-find-ruby-regexp-new-untrusted-input.md)

guidance based on ruby-lang.org Oct 23 advisory

2026-10-23

### Tip: grep your Ruby code for regexes built from user input before deciding the Onigmo fix can wait

- **Search:** `rg -n "Regexp\.(new|union|compile)|/#\{" app lib` and check whether any argument can come from params, headers, uploaded config or database fields users can edit (search filters, CI rules and webhook rules are common).
- **Prioritize:** anything multi-tenant or internet-facing that accepts patterns gets Ruby 4.0.9, 3.4.12 or 3.3.13 first. Rebuild container images; a Gemfile change does not update the interpreter.
- **Interim:** replace user-supplied regexes with plain substring matching or `Regexp.escape`, which removes the attacker's control over pattern structure. Ruby says timeouts and length caps do not protect you.

Sources: [Ruby: Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 (Oct 23)](https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/)