GitLab fixes Duo Agent prompt injection and a CVSS 10.0 vulnerability
Start here
GitLab released patch versions 19.4.2, 19.3.5, and 19.2.8 on October 12, 2026, fixing multiple security issues. Among them, the Duo Agent Platform prompt injection vulnerability CVE-2026-96893 has a CVSS score of 7.3; authenticated users can inject specially crafted content into AI agent instructions, potentially leading to execution of unintended commands on behalf of other users. Affected versions include GitLab EE from 19.1 up to before 19.2.8, from 19.3 up to before 19.3.5, and others. The same update also fixed the highest-severity vulnerability CVE-2026-97229 with a CVSS score of 10.0: due to insufficient regex validation, unauthenticated users can execute arbitrary code on the GitLab server via specially crafted regular expressions in CI/CD configuration. Earlier versions of 19.2, 19.3, and 19.4 are affected. Additionally, CVE-2026-92883 (8.7, cross-site scripting) and CVE-2026-16301 (8.5, improper authorization in downstream pipelines) were also fixed.
Generated by AI from reports · Updated 7 hr ago
Progress timeline
- The Hacker NewsGitLab fixes CVSS 10.0 vulnerability: unauthenticated users can execute server code
GitLab fixes the most critical vulnerability CVE-2026-97229 with a CVSS score of 10.0: due to insufficient regex validation, unauthenticated users can execute arbitrary code on GitLab servers via specially crafted regular expressions in CI/CD configurations. Patches were released with 19.4.2, 19.3.5, and 19.2.8; earlier versions of 19.2, 19.3, and 19.4 are affected. The same update also fixes three high-severity vulnerabilities: CVE-2026-92883 (8.7, cross-site scripting), CVE-2026-16301 (8.5, improper downstream pipeline authorization), and CVE-2026-14814 (8.2).
- GitLabSelectedGitLab fixes prompt injection vulnerability CVE-2026-96893 in Duo Agent Platform
On October 12, 2026, GitLab released patch versions 19.4.2, 19.3.5, and 19.2.8, fixing the prompt injection vulnerability CVE-2026-96893 in the GitLab Duo Agent Platform and other security issues. This vulnerability has a CVSS score of 7.3; authenticated users can inject specially crafted content into AI agent instructions, potentially leading to unintended commands being executed on behalf of other users. Affected versions are GitLab EE from 19.1 up to but not including 19.2.8, from 19.3 up to but not including 19.3.5, and from 19.4 up to but not including 19.4.2. It was discovered internally by GitLab team member Mert Coskuner. The same batch of patches also fixed an integer overflow vulnerability in the CI/CD regex compiler, CVE-2026-97229 (CVSS 10.0), and a governance control bypass vulnerability in the Duo Agent Platform, CVE-2026-105458 (CVSS 4.3).
Related discussion
Attention trend
New sources per day
- Oct 13: 2 new sources (2 outlets, 0 accounts)
- Oct 14: 0 new sources (0 outlets, 0 accounts)