Comment by dvdkon

As far as I can tell, it requires forcing GitLab to render a malicious org-mode file. I don't really see a way to do that without authenticating and uploading one. Am I missing something?