Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git
A researcher, depthfirst, has published a proof-of-concept exploit targeting GitLab 18.11.3 and earlier, allowing authenticated users to execute arbitrary commands as the ‘git’ user. The vulnerability stems from flaws within the Oj JSON parser and can be triggered by submitting specially crafted Jupyter notebooks. While GitLab.com was patched by June 10, self-managed deployments require upgrading to a supported version (18.10.8, 18.11.5, 19.0.2) to mitigate the risk. The exploit leverages a chain of vulnerabilities to achieve remote code execution.
A security researcher, depthfirst, has published a working proof-of-concept (PoC) exploit targeting GitLab 18.11.3 and earlier versions, enabling authenticated users to execute arbitrary commands as the ‘git’ user. The vulnerability is rooted in flaws within the Oj JSON parser, a high-performance JSON parser for Ruby with substantial native C code. The exploit is triggered by submitting specially crafted Jupyter notebooks to GitLab, specifically through a repository-controlled .ipynb JSON file passed to Oj::Parser.usual.parse within a long-lived Puma worker.
Successful exploitation requires no administrator rights, continuous integration (CI) runner access, victim interaction, or access to another user’s project. The exploit leverages a chain of vulnerabilities, including a callback pointer control and an ASLR address leak, to achieve remote code execution. The researchers demonstrated the exploit in a local GitLab 18.11.3 x86-64 lab, connecting a Puma worker as ‘git’.
GitLab’s notebook renderer passes repository-controlled .ipynb JSON to Oj::Parser.usual.parse inside a long-lived Puma worker. This sends attacker-controlled notebook data into Oj's native parser state within GitLab's application process. The exploit involves two lexically ordered notebook files in one diffs_stream request, keeping both stages within the same Puma worker, which reuses the process-global Oj parser.
GitLab released the fixed versions on June 10 and resolved the report on July 17, according to depthfirst. The Oj 3.17.3 bump was listed under bug fixes rather than in the security-fix table and did not describe the notebook-diff RCE chain. Dedicated customers need no action; self-managed operators should move to a supported release containing the fix (18.10.8, 18.11.5, 19.0.2).