GitLab Self-Managed RCE via Crafted Jupyter Notebook Commit Diff (Heap Leak)

Technical Analysis

The exploit abuses GitLab's handling of Jupyter notebook rendering: an attacker commits a specially crafted .ipynb file and triggers viewing of its commit diff, causing a heap memory leak that can be leveraged to achieve command execution in the context of the 'git' system user. The vulnerability affects self-managed GitLab 18.11.3 instances that have not applied the patch released on June 10, prior to the July 24 public disclosure of working exploit code by researchers at depthfirst. Exploitation requires only that the attacker be an authenticated user with push/commit privileges to a repository, lowering the bar significantly compared to unauthenticated RCE flaws. Successful exploitation grants command execution as 'git', which can be used to pivot toward CI/CD runners, stored credentials, SSH deploy keys, and repository secrets. Many organizations use GitLab repositories and CI/CD pipelines to build, test, and deploy AI agent code and RAG pipelines, and compromise of the git-level account could allow attackers to inject malicious code into agent packages, exfiltrate LLM API keys stored in CI variables, or tamper with automated agent deployment pipelines.

Affected Systems

Self-managed GitLab instances running version 18.11.3 that have not applied the June 10 security patch; GitLab.com SaaS is not affected if patched centrally; CI/CD runners and repositories hosted on vulnerable instances are indirectly at risk

Indicators of Compromise

• Malicious commits containing crafted .ipynb (Jupyter notebook) files
• Anomalous commit diff view requests correlating with heap memory access errors
• Unexpected process execution under the 'git' system user account
• Exploit PoC reportedly published by security researcher group 'depthfirst'

Remediation Steps

1. 1

   Apply GitLab Security Patch

   Immediately update self-managed GitLab instances from 18.11.3 to the patched version released June 10, 2026, or later.

2. 2

   Audit Repository Commits

   Review recent commits and commit diffs for suspicious or malformed Jupyter notebook (.ipynb) files, particularly those from newly added or low-trust contributors.

3. 3

   Restrict Push Access

   Limit which authenticated users can push directly to sensitive repositories, especially those tied to CI/CD pipelines or production deployment code.

4. 4

   Rotate CI/CD and API Secrets

   Rotate any credentials, deploy keys, and API tokens (including LLM/agent API keys) stored in or accessible via GitLab CI/CD variables on affected instances.

5. 5

   Monitor Git-User Activity

   Enable enhanced logging and monitoring for process execution and file access performed under the 'git' system account to detect exploitation attempts.

6. 6

   Isolate CI/CD Runners

   Ensure CI/CD runners used for building or deploying AI agent code operate with least-privilege access and are segmented from broader infrastructure.