Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git
GitLab RCE PoC published for unpatched servers, allowing authenticated users to run commands.
A security researcher has published a proof-of-concept exploit for a critical remote code execution vulnerability in self-managed GitLab instances. The exploit allows any authenticated user to run commands as the 'git' user by committing specially crafted Jupyter notebooks and requesting their diff. While GitLab patched the underlying Oj gem vulnerabilities six weeks prior, the fix was not classified as a security update, potentially leaving many instances vulnerable.
AI summary of the linked source. Not reviewed by an editor. How this works
Run depthfirst?
Get an email when a new story names depthfirst, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical remote code execution vulnerability in self-managed GitLab instances was exploited via a PoC after the underlying fix — applied six weeks earlier — was not labeled as a security update, causing many administrators to overlook it. This highlights a dangerous gap in patch communication: when security fixes are buried within routine dependency updates, organizations may fail to prioritize them appropriately. Any authenticated user could exploit this flaw to execute arbitrary commands as the 'git' user, representing a significant privilege escalation risk. The incident underscores why organizations must treat all third-party library updates as potentially security-relevant, especially in critical developer infrastructure like GitLab.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.