Vulnerability · Published Oct 2, 2026 · Assigned by GitLab
CVE-2026-90970Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway
Critical 9.9
In plain English
A critical-severity security flaw in GitLab AI Gateway from GitLab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 17.5% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, resulting in arbitrary command execution on the AI Gateway.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| GitLab | GitLab AI Gateway | 18.1.6 – before 19.2.419.3 – before 19.3.219.4 – before 19.4.1 |
Weakness: CWE-1336 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H