GitLab Vulnerabilities Allow Attackers to Execute Remote Code on Default GitLab Installations

A researcher from Depthfirst disclosed an exploit chain combining two long-standing memory-safety flaws in the Oj C-based Ruby JSON parser used by GitLab that allows an authenticated user with push and diff-view access to achieve remote code execution as the "git" user. The chain abuses an unchecked nesting-stack write and a 16-bit key-length pointer leak to corrupt a parser callback pointer and defeat ASLR, enabling arbitrary command execution and potential exposure of source code, Rails secrets, and internal services; affected GitLab and Oj versions are listed and patches were released.