What happened
Published 2026-10-13 (CVSS 7.3) via GitLab advisory. 'Under certain conditions' an authenticated user injects content into AI agent instructions, potentially causing unintended command execution attributed to other users. Verified via NVD REST API.
Why it matters
GitLab Duo is enterprise-wide agentic tooling whose agents run with the invoking user's permissions. This is prompt injection in the agent instruction channel that can pivot a benign actor's actions into command execution under another user's identity — an authorization and accountability break at the agent layer of the CI/CD platform.
Attack vector
Improper neutralization of special elements in AI conversation context construction: an authenticated user seeds AI agent instructions with crafted content (e.g., via issue/comment/agent configuration the agent reads) so the agent executes unintended commands that are attributed to another user's session.
Affected systems
GitLab EE 19.1–19.2.8, 19.3–19.3.5, 19.4–19.4.2 (GitLab Duo AI agent / agent instructions)
Mitigation
Upgrade to GitLab EE 19.2.8 / 19.3.5 / 19.4.2 per patch release.