A critical vulnerability, CVE-2024-4323, has been disclosed in GitLab’s project import feature, allowing attackers to achieve remote code execution (RCE) on self-managed GitLab instances. The flaw exists in the way GitLab handles imported archives during the migration process. When a crafted project import file containing malicious YAML configurations or hooks is uploaded, the application fails to fully sanitize user-supplied data before deserialization. This oversight enables attackers to inject arbitrary Ruby code that executes on the server. The impact is severe: with a successful exploit, attackers can escalate privileges, extract sensitive data from repositories, or deploy backdoors for persistence. What makes this vulnerability even more dangerous is that it requires no prior authentication if the GitLab instance is configured to allow public project imports—a common setting for collaborative environments. GitLab has released patches in the latest version, and all administrators are urged to update immediately. If patching isn’t possible, disabling project imports or enforcing strict access controls can serve as temporary mitigations. For security researchers and bug bounty hunters, this CVE underlines why input sanitization in deserialization routines remains one of the most exploited attack surfaces in modern applications.