Improper Neutralization of Special Elements in Output Used by a Downstream Component in GitLab AI Gateway - CVE-2026-90970
Published: October 5, 2026
Vulnerability identifier: #VU153238
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-90970
CWE-ID: CWE-74
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary commands on the AI Gateway.
The vulnerability exists due to improper neutralization in the custom flow prompt template when processing a specially crafted flow configuration. A remote user can escape the prompt template sandbox to execute arbitrary commands on the AI Gateway.
Exploitation requires Duo Agent Platform access.
Affected software
GitLab AI Gateway
How to mitigate CVE-2026-90970
Install security update from vendor's website.
GitLab AI Gateway - addressed in versions 19.2.4, 19.3.2, 19.4.1