GitLab RCE PoC Exploit Allows Authenticated Users to Execute Commands as Git

Security researcher Yuhang Wu at depthfirst has published a working proof-of-concept (PoC) exploit for a remote code execution (RCE) vulnerability in self-managed GitLab instances. The exploit targets GitLab Community Edition (CE) and Enterprise Edition (EE) versions 15.2.0 through 18.10.7, 18.11.0 through 18.11.4, and 19.0.0 through 19.0.1. It allows an authenticated user to execute commands as the git user by committing two crafted Jupyter notebooks and requesting their diff. The attack requires no administrator rights, CI runner access, victim interaction, or access to another user’s project.

The vulnerability chain exploits flaws in the Oj JSON parser for Ruby, affecting gems 3.13.0 through 3.17.1. The first bug corrupts a callback pointer, while the second leaks a heap address to bypass ASLR. Successful exploitation can lead to access to source code, Rails secrets, service credentials, CI/CD data, and internal services. GitLab.com was patched by June 10, 2026. Self-managed operators are urged to upgrade to fixed versions 18.10.8, 18.11.5, or 19.0.2. No temporary workaround is available. No CVE identifiers have been assigned yet.