Injection Vulnerability in GitLab EE Affecting Multiple Versions
CVE-2026-96893

7.3HIGH

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
13 October 2026

What is CVE-2026-96893?

GitLab EE has identified a significant vulnerability that affects various versions by allowing authenticated users to inject crafted content into AI agent instructions. This flaw could lead to unintended command executions attributed to other users due to improper handling of special elements in the AI conversation context. Users are advised to update to the patched versions to mitigate potential risks associated with this vulnerability.

Affected Version(s)

GitLab 19.1 < 19.2.8

GitLab 19.3 < 19.3.5

GitLab 19.4 < 19.4.2

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/607968
https://docs.gitlab.com/releases/patches/patch-release-gi...

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability has been discovered internally by GitLab team member Mert Coskuner.
.