Researcher Publishes Git Lab RCE PoC Letting Authenticated Users Run Commands as Git
Summary: Researchers at depthfirst published working exploit code on July 24 for a GitLab flaw patched on June 10, letting any authenticated user who can push to a project run commands as git on unpatched self-managed 18.11.3 servers. The chain abuses two memory corruption bugs in the Oj Ruby JSON parser, reached through GitLab's ipynbdiff notebook renderer, and GitLab listed the Oj 3.17.3 bump under bug fixes rather than in its security-fix table, with no CVE or CVSS score.
Why it matters: Operators who triaged the June 10 release against the security-fix table had no reason to treat it as urgent, and installs on 15.2 through 18.9 get no backport at all, so they must move to a supported release. Commands run as git, the account behind Puma, putting source code, Rails secrets, service credentials, and CI/CD data in reach.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026