A security researcher has released a proof-of-concept (PoC) exploit demonstrating a remote code execution (RCE) vulnerability in GitLab’s self-managed servers. This exploit enables authenticated users to execute commands as the ‘git’ user without requiring administrative privileges or user interaction.
The exploit targets GitLab Community Edition (CE) and Enterprise Edition (EE) versions 15.2.0 through 18.10.7, 18.11.0 through 18.11.4, and 19.0.0 through 19.0.1. The vulnerability stems from issues in the Oj gem, a high-performance JSON parser for Ruby, which GitLab uses to process Jupyter notebook files. By committing two specially crafted Jupyter notebooks and requesting their diff, an authenticated user can trigger the exploit.
GitLab has addressed these vulnerabilities in versions 18.10.8, 18.11.5, and 19.0.2. Administrators of self-managed GitLab instances are strongly advised to upgrade to these patched versions to mitigate the risk. It’s important to note that GitLab.com was patched by June 10, 2026, and dedicated customers do not need to take further action.
Successful exploitation allows code execution with the privileges of the ‘git’ user. The potential impact depends on the deployment’s isolation but could include access to source code, Rails secrets, service credentials, CI/CD data, and internal services reachable from the application.
As of July 24, 2026, there have been no reports of this vulnerability being exploited in the wild. However, given the availability of the PoC exploit, it’s crucial for administrators to apply the necessary updates promptly to protect their systems.
This incident underscores the importance of timely patching and vigilance in monitoring for security advisories. Organizations should establish robust processes for applying security updates to mitigate potential threats effectively.
