GitLab RCE via two memory corruption vulnerabilities in the Ruby Oj gem
Attack Techniques & Methods2026-07-28, 13:02
Researchers at depthfirst demonstrated an RCE chain in GitLab through the processing of diffs for Jupyter Notebooks. A specially crafted
.ipynb file is passed to ipynbdiff and then to the native Oj JSON parser, where the first vulnerability enables an out-of-bounds array write, while the second enables a heap address leak to bypass ASLR.
As a result, an attacker can replace the parser callback and achieve execution of system() inside a Puma worker running as the git user.The chain:
.ipynb in a Git repository → GitLab notebook diff → ipynbdiff → Oj C extension → OOB write → replacement of p->start → heap pointer leak → recovery of libc/libruby base → call to system()
The attack does not require administrator privileges, access to CI, or user interaction—it is sufficient to be able to push commits to a project and open the diff. GitLab CE/EE versions starting with 15.2.0 are affected. Fixes were included in 18.10.8, 18.11.5, and 19.0.2, while the secure version of Oj is 3.17.3.
Vendors
Products
More