A critical remote code execution (RCE) chain has been discovered in GitLab, allowing authenticated users to execute arbitrary code on unpatched versions. This vulnerability is the result of chaining two memory corruption bugs in the Oj Ruby JSON parser, which has a native C implementation. By exploiting these bugs via Jupyter notebook diffs, an attacker can achieve full command execution inside a GitLab Puma worker without requiring admin rights, CI access, or victim interaction. The exploit, published by Depthfirst researchers, can be run by any authenticated user who can push to a project and view commit diffs1. This RCE chain has significant implications for GitLab users, as it can be used to compromise the security of GitLab instances. So what matters to practitioners is that they must patch their GitLab instances immediately to prevent potential attacks exploiting this critical vulnerability.