GitLab RCE Exploit Released: Authenticated Users Can Run Commands as Git

Robert Moore · 2026-07-25

Security researchers at depthfirst just dropped working exploit code for a GitLab flaw that was patched over a month ago. If you run a self-managed GitLab 18.11.3 server and haven't updated yet, this is your wake-up call. The vulnerability lets any authenticated user who can push to a project execute arbitrary commands as the git user on the server. ### How the Attack Works The exploit is deceptively simple. An attacker commits a specially crafted Jupyter notebook to a repository. Then, they open the commit diff view, which triggers a heap leak that allows command execution. No special permissions needed beyond basic push access. ### Why This Matters This isn't a theoretical risk. The exploit code is public, meaning anyone with basic GitLab access can potentially take over your server. If you have multiple users with push permissions, your attack surface just got a lot bigger. The researchers published the code on July 24, about six weeks after GitLab released a patch on June 10. That's plenty of time for attackers to reverse-engineer the fix and weaponize it. ### Who Should Act Now - System administrators managing self-hosted GitLab instances - DevOps teams running CI/CD pipelines on GitLab - Organizations with multiple contributors to private repositories - Anyone using GitLab 18.11.3 who hasn't updated ### What to Do 1. Update GitLab immediately to the latest version. The patch was released on June 10, so any version after that should be safe. 2. Review user permissions and remove unnecessary push access. 3. Monitor for suspicious commits, especially Jupyter notebooks. 4. Check logs for unusual command execution or unexpected processes running as git. ### The Bigger Picture This incident highlights a common pattern in cybersecurity: the gap between patch release and exploit publication. Researchers often wait for patches to be available before releasing PoC code, but that window can be weeks. During that time, unpatched systems are sitting ducks. The lesson? Patch early and often. Don't assume you're safe just because a fix exists. ### Final Thoughts If you're running a self-managed GitLab instance, treat this as urgent. The exploit is out there, and it's easy to execute. Don't wait for a breach to take action. Update now, audit your users, and stay vigilant.