CVSS 7.3 (high) · published 2026-10-13
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing unintended command execution attributed to other users, due to improper neutralization of special elements in AI conversation context construction.
Affected products (NVD): gitlab gitlab
Fixed in (NVD): 19.2.8, 19.3.5, 19.4.2
Weakness: CWE-74
Source: NVD CVE-2026-96893
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.