Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git

Security researcher Yuhang Wu at depthfirst has published a working proof-of-concept (PoC) exploit that executes commands as git on an unpatched self-managed GitLab 18.11.3 server. An ordinary authenticated user triggers it by committing two crafted Jupyter notebooks and requesting their diff. The chain needs no administrator rights, continuous integration (CI) runner access, victim interaction

The article reports that researcher Yuhang Wu released a working PoC for a GitLab remote code execution chain in self-managed GitLab 18.11.3, allowing any ordinary authenticated user to run commands as the git user by committing two crafted Jupyter notebooks and requesting their diff, with no need for admin rights, CI runner access, or victim interaction.[1] The underlying bugs affect a broad range of GitLab CE/EE versions, with fixes only in specific later releases.[1] From a RealGround perspective, this is a software supply chain and infrastructure risk for organizations that use GitLab to host code, models, or AI agent configurations: compromise of the git user on a GitLab server can enable tampering with AI-related repositories, pipelines, and SBOMs, leading to malicious model or agent updates that downstream AI systems may trust. Mitigation requires rapid patching to the fixed GitLab versions, incorporating GitLab into AI supply chain inventories/SBOMs, and enforcing strong change-control and integrity monitoring on AI-related repos so that an exploited GitLab instance cannot silently alter AI models, prompts, or agent logic.