Two Oj JSON Parser Bugs Enable GitLab Remote Code Execution
A researcher chained an out‑of‑bounds write and a heap‑pointer leak in the native Oj JSON parser to achieve remote code execution on GitLab CE/EE versions 15.2‑19.0.1. The flaw required only push access, exposing self‑managed GitLab installations to full system compromise until patches were released.