Cicd

GitLab RCE PoC: Any Project Pusher Can Run Commands as Git via Notebook Diff Rendering

Researchers at depthfirst published working exploit code for an unfiled GitLab RCE: a two-bug chain in the Oj JSON parser behind Jupyter notebook diff rendering lets any user who can push to a project run commands as git on unpatched self-managed instances.