Security researcher Yuhang Wu at depthfirst on July 24 published a working proof-of-concept exploit that executes commands as the git user on unpatched self-managed GitLab 18.11.3 servers. The chain works for any authenticated user who can push to a project and requires no admin rights, no CI runner access, no victim interaction and no access to another user's project.
Two Ruby Oj Parser Bugs, One Notebook Diff
The vulnerability lives inside GitLab's notebook renderer, which passes attacker-controlled .ipynb JSON to Oj, the high-performance Ruby JSON parser. The exploit uses two lexically ordered Jupyter notebook files in a single diffs_stream request. The first notebook corrupts a callback pointer via a stack overflow in Oj's fixed 1,024-byte nesting stack; the second triggers the corrupted callback and reaches system() through a build-specific gadget sequence. A separate heap-address leak, produced by a length-truncation bug in Oj's object-key handling, narrows the ASLR search to five to ten minutes on a two-worker installation.
Affected Versions And Fixes
The public exploit is build-specific to GitLab CE/EE 18.11.3 on x86-64, but the underlying Oj bugs affect broader ranges: GitLab CE/EE 15.2.0 through 18.10.7, 18.11.0 through 18.11.4, and 19.0.0 through 19.0.1. The first fixed GitLab releases are 18.10.8, 18.11.5 and 19.0.2. Published Oj gems 3.13.0 through 3.17.1 are vulnerable, with 3.17.3 the first release containing both fixes. GitLab.com was patched on June 10, so dedicated customers need no action. Self-managed operators, including Helm and Operator users, must move to a supported release containing the fix; there is no temporary workaround.
A CVE-Less Security Fix
Neither depthfirst's disclosure nor GitLab's June 10 release notes assign CVE identifiers or CVSS scores to the two chain bugs, and GitLab listed the Oj bump under "bug fixes" rather than in the security-fix table. depthfirst reported the Oj bugs on May 21 and the GitLab chain on June 5; the maintainer merged fixes on May 27 and Oj 3.17.3 shipped June 4. The researchers said they were unaware of in-the-wild exploitation as of July 24. Successful exploitation runs as git and can reach source code, Rails secrets, service credentials, CI/CD data and internal services reachable from the application - a substantial supply-chain footprint given GitLab's use across enterprise DevOps and defense contractors also chasing emerging AI agent security threats and agentic AI cyber defenses.
Reporting based on coverage from The Hacker News and depthfirst's technical analysis.