CVE-2026-96893: crafted content in GitLab Duo Agent Platform instructions could run commands credited to other users

Vulnerability · GitLab Duo Agent Platform · HIGH

Incident dateNot stated

DisclosedOct 12, 2026 (GitLab critical patch release). NVD published Oct 13, 2026.

Added hereOct 14, 12:32 PM ET

Last verifiedOct 14, 2026

Summary

GitLab fixed CVE-2026-96893 in its Oct 12, 2026 critical patch release. The flaw was in the GitLab Duo Agent Platform, GitLab's AI agents for software development. GitLab says an authenticated user could inject specially crafted content into AI agent instructions, which could cause unintended command execution attributed to other users. The cause was improper neutralization of special elements when GitLab built the AI conversation context. GitLab EE 19.1 through 19.2.7, 19.3 before 19.3.5 and 19.4 before 19.4.2 are affected. GitLab.com already runs the fix, and GitLab Dedicated customers do not need to act.

Severity

HIGH A signed-in user could steer an AI agent into running commands that were then attributed to someone else. GitLab scores it CVSS 3.1 7.3 High: network attack, low complexity, low privileges, and user interaction required. CISA's assessment on NVD lists no known exploitation. GitLab found it internally, and fixes are out for all supported versions.

Timeline

Oct 12, 2026
GitLab releases critical patch versions 19.4.2, 19.3.5 and 19.2.8, including the fix for CVE-2026-96893.
Oct 13, 2026
NVD publishes CVE-2026-96893 (02:17 UTC), and later marks it Analyzed.

How it happened

GitLab describes it as an 'Improper Neutralization of Input Used for LLM Prompting' issue in the Duo Agent Platform. Content a user could supply ended up in the instructions the AI agent received, without being neutralized, so it could change what the agent did. Because the agent was acting in another user's session, the resulting commands were attributed to that user. NVD lists CWE-74 (injection). GitLab has not published further technical detail. The NVD record links GitLab work item #607968, which showed no details when we checked. The issue was discovered internally by GitLab team member Mert Coskuner.

How to check your app

If you run self-managed GitLab EE with Duo Agent Platform, upgrade to 19.4.2, 19.3.5 or 19.2.8 or later.
GitLab.com and GitLab Dedicated are already patched.
Review recent agent sessions and the commands they ran, especially where agents read content that other users can edit.

Sources

Corrections and updates

None. Re-checked against every source on Oct 14, 2026.

If you want someone to check your own app for problems like this, LockedVibe, which has the same owner as this site, lists its security scans on its pricing page. Disclosure.