Critical GitLab RCE Vulnerability Exploits Ruby JSON Parser Flaws
A newly disclosed vulnerability in GitLab allows remote code execution (RCE) by chaining two long-standing memory-safety flaws in the Oj JSON parsing library, a high-performance Ruby dependency. Discovered by Yuhang Wu of the Open Defense Initiative, the exploit targets default GitLab installations, enabling attackers to execute arbitrary commands, access repositories, steal secrets, and compromise internal services.
The attack leverages Jupyter Notebook (.ipynb) file processing in GitLab, which uses the ipynbdiff gem to parse notebooks with Oj before displaying differences. By submitting maliciously crafted notebooks in a single commit-diff request, an authenticated user with standard push and diff-view permissions could corrupt memory, bypass Address Space Layout Randomisation (ASLR), and gain code execution as the “git” system user.
The vulnerabilities an unchecked nesting-stack write and an unsafe 16-bit key-length narrowing issue had gone undetected for nearly five years. While individually limited, their combination allowed heap manipulation, callback pointer control, and arbitrary command execution. Unlike prior GitLab RCE exploits that relied on SSRF against Redis, this attack bypasses modern protections by targeting a memory-unsafe native dependency in Ruby.
Affected Versions & Fixes
The flaw impacts GitLab CE/EE versions 15.2.0–18.10.7, 18.11.0–18.11.4, and 19.0.0–19.0.1, with patches released in 18.10.8, 18.11.5, and 19.0.2. The Oj gem (versions 3.13.0–3.17.1) was fixed in 3.17.3. GitLab.com was patched pre-disclosure, while self-managed instances require immediate upgrades.
The vulnerabilities were reported on 21 May 2026, with Oj fixes merged on 27 May and released on 4 June. GitLab confirmed and patched the exploit chain by 10 June 2026. The same research also uncovered nine additional CVEs in Oj, including buffer overflows and use-after-free flaws, underscoring risks in memory-unsafe Ruby extensions.
Source: https://thecyberexpress.com/gitlab-vulnerability-oj-parser-rce/
GitLab cybersecurity rating report: https://www.rankiteo.com/company/gitlab-com
"id": "GIT1785155190",
"linkid": "gitlab-com",
"type": "Vulnerability",
"date": "5/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Self-managed GitLab instances '
'and GitLab.com users',
'industry': 'Technology/DevOps',
'name': 'GitLab',
'type': 'Software Provider'}],
'attack_vector': 'Maliciously crafted Jupyter Notebook (.ipynb) files in '
'commit-diff requests',
'customer_advisories': 'GitLab.com patched pre-disclosure; self-managed '
'instances advised to upgrade immediately.',
'data_breach': {'file_types_exposed': ['.ipynb (Jupyter Notebook)'],
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Repositories', 'Secrets']},
'date_detected': '2026-05-21',
'date_publicly_disclosed': '2026-06-10',
'date_resolved': '2026-06-10',
'description': 'A newly disclosed vulnerability in GitLab allows remote code '
'execution (RCE) by chaining two long-standing memory-safety '
'flaws in the Oj JSON parsing library, a high-performance Ruby '
'dependency. The exploit targets default GitLab installations, '
'enabling attackers to execute arbitrary commands, access '
'repositories, steal secrets, and compromise internal '
'services. The attack leverages Jupyter Notebook (.ipynb) file '
'processing in GitLab, which uses the ipynbdiff gem to parse '
'notebooks with Oj before displaying differences. By '
'submitting maliciously crafted notebooks in a single '
'commit-diff request, an authenticated user with standard push '
'and diff-view permissions could corrupt memory, bypass '
'Address Space Layout Randomisation (ASLR), and gain code '
"execution as the 'git' system user.",
'impact': {'data_compromised': ['Repositories', 'Secrets'],
'operational_impact': 'Compromise of internal services',
'systems_affected': ['GitLab CE/EE']},
'investigation_status': 'Completed',
'lessons_learned': 'Risks in memory-unsafe Ruby extensions and the importance '
'of timely patching for dependencies.',
'post_incident_analysis': {'corrective_actions': ['Patching Oj gem',
'Releasing GitLab security '
'updates',
'Enhancing dependency '
'security reviews'],
'root_causes': ['Memory-safety flaws in Oj JSON '
'parsing library',
'Unpatched vulnerabilities in Ruby '
'dependencies']},
'recommendations': ['Immediately upgrade GitLab to patched versions (18.10.8, '
'18.11.5, 19.0.2)',
'Upgrade Oj gem to version 3.17.3 or later',
'Monitor for suspicious commit-diff requests involving '
'.ipynb files'],
'references': [{'source': 'Open Defense Initiative (Yuhang Wu)'}],
'response': {'containment_measures': 'Patches released for affected versions',
'remediation_measures': ['Upgraded Oj gem to version 3.17.3',
'Released GitLab patches (18.10.8, '
'18.11.5, 19.0.2)']},
'title': 'Critical GitLab RCE Vulnerability Exploits Ruby JSON Parser Flaws',
'type': 'Remote Code Execution (RCE)',
'vulnerability_exploited': ['CVE (Oj gem vulnerabilities)',
'Unchecked nesting-stack write',
'Unsafe 16-bit key-length narrowing issue']}