Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git
A public GitLab 18.11.3 PoC chains two Oj parser bugs through crafted Jupyter notebook diffs to execute commands as git without admin rights.
More info