GitLab patches critical remote‑code‑execution flaw in Oj JSON parser

Security researchers identified a chain of two long‑standing memory‑safety bugs in the native C‑based Ruby JSON parser Oj that could be exploited to achieve remote code execution on default GitLab installations. The exploit leverages GitLab’s handling of Jupyter Notebook (.ipynb) files: an attacker who can push commits and view diff outputs can craft malicious notebook files that trigger an out‑of‑bounds write and a heap‑pointer disclosure, eventually executing arbitrary commands as the “git” system user.

The vulnerability, present since GitLab version 15.2.0 (July 2022), was disclosed after researchers from the Depthfirst project and the Open Defense Initiative, led by Yuhang Wu, published a working exploit. GitLab released a patch on June 10, 2026, but listed it under general bug fixes rather than the security advisory table, leading to delayed triage by operators.

The fix addresses the two Oj bugs—an unchecked nesting‑stack overflow and an unsafe 16‑bit key‑length narrowing issue—removing the attack path and restoring the integrity of the notebook diff renderer.