Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

GitLab notebook diff authenticated RCE flaw

Vulnerability
First reported
Last updated
Happening score
H score 37
1 unique sources, 1 articles

Summary

Hide ▲

A public PoC exploit now shows an authenticated RCE path in GitLab that can run commands as git on vulnerable self-managed servers. The flaw affects GitLab CE/EE 15.2.0 through 18.10.7, 18.11.0 through 18.11.4, and 19.0.0 through 19.0.1, with the exploit demonstrated against GitLab 18.11.3. GitLab fixed the issue in 18.10.8, 18.11.5, and 19.0.2, and successful exploitation can expose source code, Rails secrets, service credentials, and CI/CD data.

Related Happenings

Oj parser state corruption and ASLR leak analysis in the GitLab notebook diff exploit chain

Technical Analysis
H score23 First: 25.07.2026 11:34 Last: 25.07.2026 11:34 Sources 1

How related: depthfirst's technical analysis shows how one bug controls a callback pointer, while the other leaks a heap address needed to narrow the address space layout randomization (ASLR) search.

About this happening: Researchers published deep exploit analysis of Oj parser bugs in GitLab's notebook diff path, showing how callback-pointer corruption and a heap-address leak can b...

Open Happening

GitLab CE/EE SSRF flaw (CVE-2021-39935)

Vulnerability
H score1 First: 04.02.2026 17:42 Last: 04.02.2026 17:42 Sources 1

About this happening: GitLab CE/EE CVE-2021-39935 is an actively exploited SSRF flaw that lets unauthenticated external users make server-side requests through the CI Lint API. The...

Open Happening

GitLab authentication services 2FA bypass (CVE-2026-0723)

Vulnerability
H score66 First: 21.01.2026 15:57 Last: 21.01.2026 15:57 Sources 1

About this happening: GitLab CE/EE patched CVE-2026-0723, an unchecked return value flaw in authentication services that could let an attacker who knew a victim's account ID bypass two-fa...

Open Happening

Timeline

  4. 05.06.2026 03:00 1 articles · 1mo ago

    Researchers publish GitLab notebook-diff RCE chain

    Initial Disclosure

    Researchers reported a GitLab notebook-rendering RCE chain that lets an authenticated user execute commands as git on an unpatched self-managed GitLab 18.11.3 server by committing two crafted Jupyter notebooks and requesting their diff.

    Show sources
    Open in new tab
  6. 21.05.2026 03:00 2 articles · 2mo ago

    depthfirst reports Oj parser bugs that underlie the GitLab notebook-diff RCE chain

    Technical Analysis Update

    depthfirst reported Oj parser bugs that later underpinned the GitLab notebook-diff RCE chain and said the same review uncovered nine CVEs for other Oj flaws.

    Show sources
    Open in new tab