---
id: 5434
title: "Going depthfirst: Achieving GitLab RCE via Two Ruby Memory Corruption Vulnerabilities"
source_domain: depthfirst.com
source_url: "https://depthfirst.com/research/going-depthfirst-achieving-gitlab-rce-via-two-ruby-memory-corruption-vulnerabilities"
published_at: "2026-07-24 12:00"
tags: ["rce", "featured", "vulnerability-research", "gitlab", "ruby", "memory-safety", "memory-corruption", "oj-parser"]
phying_url: "https://phying.com/item/5434"
lang: en
---

# Going depthfirst: Achieving GitLab RCE via Two Ruby Memory Corruption Vulnerabilities

## Summary

We chained two memory-safety flaws in Oj, a native Ruby JSON parser used by GitLab's notebook diff renderer, into remote code execution in a Puma worker. The path begins with an attacker-controlled Jupyter notebook and crosses GitLab, ipynbdiff, CRuby, and jemalloc before reaching function-pointer control.

## Intelligence Metadata

- **Sources:** depthfirst.com
- **Published:** 2026-07-24 12:00
- **Original:** https://depthfirst.com/research/going-depthfirst-achieving-gitlab-rce-via-two-ruby-memory-corruption-vulnerabilities
- **Phying News:** https://phying.com/item/5434