Affected Systems

GitLab CE/EE self-managed instances: versions 15.2.0–18.10.7, 18.11.0–18.11.4, and 19.0.0–19.0.1. All tiers (Free through Ultimate) affected. Underlying flaw in Oj gem 3.13.0–3.17.1. GitLab.com SaaS not affected.

Exploitation Status

Public PoC exploit published July 24, 2026. Built for GitLab 18.11.3 on x86-64; porting to other versions requires effort but Oj bugs are general. No known in-the-wild exploitation reported. Exploit requires authenticated user with push access to a project.

Business Impact

Authenticated users with push access can execute arbitrary commands as the git user by committing a malicious Jupyter notebook and viewing its diff. Attacker gains access to source code, Rails secrets, service credentials, CI/CD data, and internal services reachable by the GitLab application. GitLab did not classify the June 10 fix as a security patch—no CVE assigned, no CVSS score, listed only as bug fix—so many operators likely did not prioritize patching. Versions 15.2–18.9 receive no backport and must upgrade to supported release trains.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately upgrade self-managed GitLab instances to version 18.10.8, 18.11.5, or 19.0.2 or later
  • For Helm and Operator deployments, verify the GitLab version inside the Webservice Puma container image, not the chart or Operator version number
  • Audit GitLab access logs for unusual Jupyter notebook (.ipynb) commits or diff views from users with push access since May 2026
  • If running GitLab 15.2–18.9 (outside security-maintained patch trains), plan migration to a supported release line immediately—no backport available
  • Review git user privileges and network segmentation to limit blast radius if RCE occurs; restrict git user access to internal services where possible

---

# Threat Actor Context

Actor Profile

depthfirst is a security research organization that published a working proof-of-concept exploit on July 24, 2026, for a GitLab remote code execution vulnerability. The organization operates an autonomous vulnerability detection system that flagged two memory corruption bugs in the Oj Ruby JSON parser. Researchers then manually chained these bugs to achieve RCE against GitLab self-managed instances. depthfirst reported the Oj bugs to the maintainer on May 21 and the GitLab exploitation chain on June 5, following coordinated disclosure practices. The organization has stated it is not aware of in-the-wild exploitation and that GitLab independently reproduced the RCE. Their broader Oj security review produced nine additional CVE advisories beyond this specific chain.

TTPs (Tactics, Techniques, Procedures)

The exploit chain leverages T1203 (Exploitation for Client Execution) and T1059.007 (Command and Scripting Interpreter: JavaScript/JScript) concepts adapted to server-side context. Initial access requires T1078 (Valid Accounts) - authenticated user credentials with push access to a GitLab project. The attack uses T1587.001 (Develop Capabilities: Malware) through crafted Jupyter notebook files (.ipynb) containing malicious JSON payloads. T1190 (Exploit Public-Facing Application) is achieved by triggering the commit diff view, which passes attacker-controlled data to Oj::Parser in the ipynbdiff gem. Two memory corruption primitives enable T1203: a stack buffer overflow writing past a 1,024-byte nesting stack to control parser callbacks, and an integer truncation bug (65,565 bytes to 29 via signed 16-bit field) that leaks heap pointers rendered into the diff output. The heap leak enables ASLR bypass, locating libc in memory. The callback overwrite redirects execution to system(), achieving T1059.004 (Command and Scripting Interpreter: Unix Shell) as the 'git' user within the Puma worker process. Commands execute with access to source code, Rails secrets, service credentials, and CI/CD data.

Targets & Patterns

The vulnerability affects operators of self-managed GitLab instances across all tiers (Community Edition and Enterprise Edition, Free through Ultimate) running versions 15.2.0 through 18.11.4, 19.0.0 through 19.0.1, and any installation using Oj gem versions 3.13.0 through 3.17.1. The attack surface is limited to authenticated users with push access to at least one project, making it particularly relevant for insider threat scenarios, compromised developer accounts, or environments with permissive repository access controls. Organizations running GitLab via Helm or Operator deployments face additional risk due to potential version confusion between chart versions and the actual Webservice image running Puma. Installations on versions 15.2 through 18.9 that fall outside GitLab's security-maintained patch trains are especially vulnerable, as no backports are available. The exploit was built specifically for GitLab 18.11.3 on x86-64 architecture, though the underlying Oj bugs are architecture-agnostic. Organizations with longer-running Puma instances (1-2 hours vs. 5-10 minutes for fresh installs) may experience extended exploitation timeframes due to memory search requirements.

Historical Context

This disclosure represents a significant case study in vulnerability disclosure classification and patch management communication. GitLab patched the vulnerability on June 10, 2026, but listed the Oj 3.17.3 dependency bump under "bug fixes" rather than security fixes in the release notes. No CVE was assigned, no CVSS score was published, and the notebook-diff exploitation chain was not documented in security advisories. This classification gap meant security teams triaging the June 10 release against the security table had no indication of urgency, potentially leaving vulnerable instances unpatched for the six weeks until depthfirst's public disclosure on July 24. The timeline shows responsible disclosure: depthfirst reported Oj bugs on May 21, the maintainer merged fixes May 27, Oj 3.17.3 shipped June 4, the GitLab chain was reported June 5, confirmed June 8, and patched June 10. The 45-day window between patch availability and PoC publication aligns with industry norms, though the lack of security classification undermined the patch's visibility. depthfirst's broader Oj review yielded nine additional CVEs, indicating systematic security analysis of the parser library.

Defensive Recommendations

  • Immediately upgrade GitLab self-managed instances to version 18.10.8, 18.11.5, 19.0.2 or later; verify the GitLab version inside the Webservice/Puma container image, not just Helm chart or Operator versions
  • Audit GitLab user accounts with push access to projects; implement least-privilege access controls and review repository permissions to limit the pool of authenticated users who could exploit this vulnerability
  • Monitor Puma worker processes for unexpected command execution as the 'git' user; establish baseline behavior for the git account and alert on anomalous process creation, network connections, or file access patterns
  • Review June 10, 2026 GitLab patch notes for the Oj 3.17.3 dependency update; treat dependency bumps in security-sensitive parsers as potential security fixes even when not explicitly classified, and prioritize testing and deployment
  • For installations on unsupported versions (15.2 through 18.9), plan immediate migration to a supported release train as no backports are available; isolate these instances from untrusted users and monitor for Jupyter notebook commits and diff view access patterns until migration is complete