Oj parser state corruption and ASLR leak analysis in the GitLab notebook diff exploit chain
Technical Analysis
Summary
Hide ▲
Show ▼
Researchers published deep exploit analysis of Oj parser bugs in GitLab's notebook diff path, showing how callback-pointer corruption and a heap-address leak can be combined to drive authenticated RCE.
Related Happenings
GitLab notebook diff authenticated RCE flaw
Vulnerability
H score37
First: 25.07.2026 11:34
Last: 25.07.2026 11:34
Sources 1
How related:
Security researcher Yuhang Wu at depthfirst has published a working proof-of-concept (PoC) exploit that executes commands as git on an unpatched self-managed GitLab 18.11.3 server.
About this happening:
A public PoC exploit now shows an authenticated RCE path in GitLab that can run commands as git on vulnerable self-managed servers. The flaw affects GitLab CE/EE...
GitLab notebook diff authenticated RCE flaw
VulnerabilityHow related: Security researcher Yuhang Wu at depthfirst has published a working proof-of-concept (PoC) exploit that executes commands as git on an unpatched self-managed GitLab 18.11.3 server.
About this happening: A public PoC exploit now shows an authenticated RCE path in GitLab that can run commands as git on vulnerable self-managed servers. The flaw affects GitLab CE/EE...
FFmpeg parser/demuxer overflows (multiple vulnerabilities)
Vulnerability
H score36
First: 06.06.2026 10:28
Last: 06.06.2026 10:28
Sources 1
About this happening:
FFmpeg now has 21 confirmed zero-days, creating risk for any product that bundles the media library and processes untrusted video input. The findings include heap and st...
FFmpeg parser/demuxer overflows (multiple vulnerabilities)
VulnerabilityAbout this happening: FFmpeg now has 21 confirmed zero-days, creating risk for any product that bundles the media library and processes untrusted video input. The findings include heap and st...
SAP security patch release for CVE-2019-17571
Security Patch Release
H score42
First: 11.03.2026 14:26
Last: 11.03.2026 14:26
Sources 1
About this happening:
SAP released security updates for two critical flaws in FS-QUO and NetWeaver Enterprise Portal Administration, reducing the risk of arbitrary code execution on...
SAP security patch release for CVE-2019-17571
Security Patch ReleaseAbout this happening: SAP released security updates for two critical flaws in FS-QUO and NetWeaver Enterprise Portal Administration, reducing the risk of arbitrary code execution on...
Timeline
-
25.07.2026 11:34 2 articles · 2h ago
Researcher publishes GitLab notebook diff exploit proof-of-concept
Technical Analysis UpdateYuhang Wu at depthfirst publishes a working proof-of-concept for an unpatched self-managed GitLab 18.11.3 server, showing that an authenticated user can commit two crafted Jupyter notebooks, request their diff, and execute commands as git without admin rights, CI runner access, victim interaction, or access to another user's project.
Show sources
- Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git — thehackernews.com — 25.07.2026 11:34
- Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git — thehackernews.com — 25.07.2026 11:34