🔴 Critical | Source: The Hacker News
A working proof-of-concept exploit has been published for a remote code execution flaw in GitLab, allowing any authenticated user with push access to run arbitrary commands as the ‘git’ system user on unpatched self-managed instances. The vulnerability is triggered by committing a specially crafted Jupyter notebook and viewing its diff, which leaks heap memory and enables code execution. GitLab patched the flaw on 10 June, but any self-managed instance still running version 18.11.3 without the update is directly at risk.
Security Architect’s Take: Prioritise patching all self-managed GitLab instances beyond version 18.11.3 immediately — with a working public PoC now available, exploitation in the wild is a near-term certainty. If patching cannot be done immediately, restrict push access to trusted users only and consider taking the instance offline or behind a VPN until the update is applied.
Original advisory: Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git