Security researchers have released a working exploit for a GitLab remote code execution (RCE) flaw (patched six weeks prior on June 10th) affecting self-managed servers running versions prior to 18.11.3. Any authenticated user with push access to a project can trigger the vulnerability by committing a specially crafted Jupyter notebook and viewing its commit diff. This action leaks heap memory, enabling command execution as the ‘git’ user.