{"id":7038,"date":"2026-07-25T10:52:18","date_gmt":"2026-07-25T10:52:18","guid":{"rendered":"https:\/\/lockitsoft.com\/?p=7038"},"modified":"2026-07-25T10:52:18","modified_gmt":"2026-07-25T10:52:18","slug":"gitlab-rce-vulnerability-exploited-weeks-after-patch-due-to-undisclosed-security-fix","status":"publish","type":"post","link":"https:\/\/lockitsoft.com\/?p=7038","title":{"rendered":"GitLab RCE Vulnerability Exploited Weeks After Patch Due to Undisclosed Security Fix"},"content":{"rendered":"

Security researchers at depthfirst have successfully developed and published working exploit code for a critical vulnerability in GitLab, a popular platform for software development and collaboration. This exploit targets a flaw that GitLab had already patched six weeks prior, on June 10, 2026. The vulnerability, which allows any authenticated user with push access to a project to execute commands with the privileges of the git<\/code> user on self-managed GitLab instances running version 18.11.3<\/code> that have not yet applied the update, highlights a concerning oversight in GitLab’s security patching process.<\/p>\n

The exploit chain is particularly insidious because it leverages two memory corruption bugs within the Oj gem, a Ruby JSON parser heavily reliant on native C code. These bugs were autonomously flagged by depthfirst’s systems and subsequently chained together by researchers. The attack vector begins with an attacker committing a specially crafted Jupyter notebook to a project. By examining the commit diff of this notebook, an attacker can extract a heap pointer. Accumulating sufficient pointers allows for the automated probing and locating of essential libraries within the server’s memory. Following this, two additional notebooks are used to trigger the payload, enabling remote code execution (RCE). Crucially, this exploit bypasses the need for administrator privileges, access to CI\/CD runners, victim interaction, or even access to other users’ projects.<\/p>\n

A significant point of concern is that GitLab did not initially classify the fix for this vulnerability as a security update. An investigation by The Hacker News revealed that the update for Oj, specifically version 3.17.3<\/code>, was listed under general bug fixes in the June 10 patch release notes, rather than in the dedicated security fix section. This omission meant that system administrators triaging the release against security bulletins would have had no reason to prioritize it as an urgent security patch, potentially leaving many systems vulnerable for an extended period. Consequently, there is no publicly assigned CVE identifier and no CVSS score associated with this specific exploit chain, further obscuring its severity from many security-conscious operators.<\/p>\n

\n
\n

Table of Contents<\/p>\nToggle<\/span><\/path><\/svg><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n