Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-90970: GitLab AI Gateway can run commands via crafted prompt
CVE-2026-90970 · published 16 days ago
Summary
The AI Gateway part of GitLab may let a signed‑in user who has Duo Agent Platform rights alter a prompt template to break out of its safe area. By doing so, they could cause the gateway to execute any command the attacker chooses. Apply the latest GitLab updates that include the fix to stop this behavior.
What to do
- Update gitlab gitlab ai gateway to version 19.2.4 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| gitlab | gitlab ai gateway | < 19.2.4 |
Original advisory text
Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway
GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, resulting in arbitrary command execution on the AI Gateway.
References
- https://gitlab.com/gitlab-org/gitlab/-/work_items/628842 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90970... Vendor Advisory
- https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-90970 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-1336Improper Neutralization of Special Elements Used in a Template Engine
Timeline
Published2 Oct 2026
Updated17 Oct 2026
First seen2 Oct 2026
Track software like this
Free during beta