Critical Remote Code Execution Vulnerability Discovered in GitLab via Oj JSON Parser Chain
What Happened — Researchers from Depthfirst chained two memory‑corruption bugs in the Ruby Oj JSON parser to achieve remote code execution (RCE) on default GitLab installations. The exploit works for any authenticated user who can push code and view notebook diffs; no admin or CI permissions are required. GitLab released a patch on June 10 2026, but the fix was listed under generic bug fixes rather than the security advisory table.
Why It Matters for Compliance & Audit Readiness
- The scenario illustrates a control gap where a low‑level library vulnerability bypasses traditional access‑control safeguards—exactly the type of risk SOC 2 Control CC6.1 (System Operations) expects organizations to monitor and evidence.
- Continuous‑compliance platforms that map application dependencies to security controls can surface such hidden flaws early, providing audit‑ready evidence that the organization maintains an up‑to‑date software‑bill‑of‑materials (SBOM) and patch‑management process.
- Verisq’s Control Mapping capability automates the linkage between discovered library bugs and the relevant SOC 2 controls, delivering real‑time evidence for auditors.
Who Is Affected — SaaS/DevOps platforms, cloud‑native development teams, and any organization running self‑hosted GitLab instances (versions ≥ 15.2.0).
Recommended Actions
- Verify that all GitLab instances are running version ≥ 15.2.0‑patch or later; apply the June 10 2026 security update immediately.
- Integrate an SBOM tool that tracks third‑party Ruby gems and flags known vulnerabilities against a CVE/Advisory feed.
- Map the Oj parser vulnerability to SOC 2 CC6.1 and capture remediation evidence in your continuous‑compliance dashboard.
Technical Notes — The exploit leverages an out‑of‑bounds write and a heap‑pointer disclosure in Oj ::Parser.usual, triggered when rendering Jupyter notebook diffs. The vulnerable code path existed for 1,753 days (Aug 2021 – June 2026). No CVE ID was assigned at time of reporting. Source: SecurityAffairs