Security researchers at depthfirst published working exploit code on July 24 for a GitLab flaw that GitLab patched six weeks earlier, on June 10. It runs commands as git on any self-managed 18.11.3 server that has not taken the update. Any authenticated user who can push to a project can run it.
Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git
Summary + source link. No paywalls, no tracking.