Ruby is supposed to be a memory-safe language. That assumption just cost GitLab administrators six weeks of quiet exposure.
Researchers at depthfirst published working exploit code on July 24 for a remote code execution chain in self-managed GitLab, targeting a flaw the company patched on June 10 — but filed under bug fixes rather than security fixes. There is no CVE, no CVSS score, and no mention of the attack path in the release notes. Anyone who triaged that release against GitLab's security table had no reason to prioritize it.
The chain starts somewhere unglamorous: GitLab's Jupyter notebook diff viewer. When a user commits an .ipynb file and opens the commit diff, an in-tree gem called ipynbdiff hands the raw repository bytes to Oj, a high-performance JSON parser written largely in native C. That C code runs inside long-lived Puma worker processes — meaning attacker-controlled bytes land in manually managed memory inside the application itself.
Two bugs in Oj, both roughly five years old, do the rest. One overflows a fixed 1,024-byte nesting stack until the attacker controls the parser's start callback. The other truncates a 65,565-byte object key to 29 in a signed 16-bit field and returns a live heap pointer, which GitLab helpfully renders into the diff page. The leak defeats ASLR; the write points the callback at system().
Any authenticated user who can push to a project can run it. No admin rights, no CI or runner access, no victim interaction, no access to anyone else's repository. Commands execute as git, the account behind Puma — putting source code, Rails secrets, service credentials, and CI/CD data within reach.
Affected: GitLab CE and EE 15.2.0–18.10.7, 18.11.0–18.11.4, and 19.0.0–19.0.1, across all tiers. Fixed in 18.10.8, 18.11.5, and 19.0.2. There is no workaround.
Helm and Operator users should check the GitLab version inside the Webservice image running Puma, not the chart version. Installs on 15.2 through 18.9 get no backport and must move to a supported release.
DepthFirst reports no known in-the-wild exploitation. Its broader Oj review produced nine additional CVEs.