Security researchers at depthfirst published working exploit code for a GitLab flaw that was patched six weeks earlier, enabling authenticated users to run commands as git on unpatched self-managed servers. The chain uses two Oj parser memory corruption bugs in GitLab’s notebook diff renderer to leak a heap pointer, find libc, and redirect execution to system(), with no CVE or security-fix classification at release time. #GitLab #Oj #depthfirst #ipynbdiff #Puma
Keypoints
- depthfirst published exploit code for a patched GitLab vulnerability on July 24.
- The flaw affects authenticated users who can push to a project on unpatched self-managed GitLab instances.
- The exploit chain abuses two Oj memory corruption bugs through GitLab’s notebook diff renderer.
- The attack can leak a heap pointer, locate libc, and run commands as the git account.
- GitLab’s fix was not listed as a security update, and affected users must upgrade to a patched release.
Read More: https://thehackernews.com/2026/07/researcher-publishes-gitlab-rce-poc.html