A security researcher at depthfirst released functional exploit code for a GitLab remote code execution vulnerability on July 24, six weeks after GitLab issued patches on June 10. The flaw affects self-managed GitLab instances running version 18.11.3 or earlier that have not applied the security update.
The attack requires authenticated access. Any user with push privileges to a project can exploit it by committing a malicious Jupyter notebook file and viewing its commit diff. This action triggers a heap leak that enables command execution with git user privileges on the target server.
Self-managed GitLab deployments face immediate risk from this vulnerability. Organizations running unpatched versions 18.11.3 or older must treat this as a priority. The public availability of working exploit code accelerates the timeline for attacks in the wild. Threat actors with valid credentials, including disgruntled employees or compromised accounts, can now escalate their access to execute arbitrary system commands.
The attack surface extends beyond external threats. Internal users with repository write permissions represent a significant risk vector. Development teams should audit recent access logs and review commit history on unpatched systems to detect exploitation attempts.
GitLab released fixes in June, but the six-week lag between patching and public exploit release suggests organizations delayed upgrades. This pattern remains common in enterprise environments where update cycles span months. The publication of proof-of-concept code transforms this from a known vulnerability into an active threat.
Organizations running self-managed GitLab should prioritize immediate patching to versions 18.12 or later, depending on their deployment track. Teams unable to upgrade immediately should restrict repository write permissions to trusted users and monitor git process execution for unusual command patterns. Those storing sensitive data in Jupyter notebooks face additional risk if attackers gain code execution, as they can access project files and potentially reach other systems on the network.
CATEGORY