What happened
GitLab remediated a critical (CVSS 9.9, CWE-1336) vulnerability in the self-hosted AI Gateway component underlying GitLab Duo AI features. An authenticated user with Duo Agent Platform access can escape the prompt-template sandbox via a specially crafted flow configuration and achieve arbitrary command execution on the AI Gateway. Affected: AI Gateway from 18.1.6 to before 19.2.4, 19.3 to before 19.3.2, and 19.4 to before 19.4.1. The CVE was published 2026-10-02 and was actively surfaced in the 2026-11-03/04 vulnerability window.
Why it matters
The prompt-template sandbox is the security boundary between untrusted prompt/template content and the host running GitLab's LLM features. Escaping it yields RCE on the AI Gateway, so an attacker who reaches the AI layer can pivot to the host and the credentials/secrets the gateway holds — the same sandbox-escape-to-host concern that keeps appearing across agentic/GenAI infrastructure.
Attack vector
An authenticated user with Duo Agent Platform access submits a specially crafted flow configuration that escapes the prompt-template sandbox, achieving arbitrary command execution on the self-hosted AI Gateway.
Affected systems
GitLab AI Gateway (Code Suggestions / AI Assist) up to 19.4.0.
Mitigation
Upgrade GitLab AI Gateway to 19.2.4 / 19.3.2 / 19.4.1 per the GitLab advisory (work item 628842).