{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-96893",
    "name": "CVE-2026-96893",
    "vendor": "GitLab EE",
    "description": "NVD published CVE-2026-96893 on 13 October 2026, with GitLab as CNA and a CVSS 3.1 score of 7.3, referencing GitLab's 19.4.2 patch release. In GitLab EE 19.1 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2, an authenticated user could, under certain conditions, inject specially crafted content into AI agent instructions in the Duo Agent Platform, because special elements were not neutralized when the AI conversation context was built. That could cause command execution attributed to other users. GitLab has not published further technical detail beyond work item 607968, and no exploitation has been reported.",
    "website": "https://nvd.nist.gov/vuln/detail/CVE-2026-96893",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-10-13",
    "risk": {
      "score": 73,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-96893",
      "aliases": [
        "ti-149"
      ],
      "title": "CVE-2026-96893: Crafted Content in GitLab Duo Agent Platform Instructions Could Run Commands Attributed to Other Users (CVSS 7.3)",
      "summary": "NVD published CVE-2026-96893 on 13 October 2026, with GitLab as CNA and a CVSS 3.1 score of 7.3, referencing GitLab's 19.4.2 patch release. In GitLab EE 19.1 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2, an authenticated user could, under certain conditions, inject specially crafted content into AI agent instructions in the Duo Agent Platform, because special elements were not neutralized when the AI conversation context was built. That could cause command execution attributed to other users. GitLab has not published further technical detail beyond work item 607968, and no exploitation has been reported.",
      "severity": "high",
      "cvss": {
        "score": 7.3,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Prompt injection"
      ],
      "componentType": "agent",
      "component": {
        "name": "GitLab EE",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "GitLab EE 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 (Duo Agent Platform).",
          "fixed": "19.2.8"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-10-13",
      "modifiedAt": "2026-10-13",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96893"
        }
      ],
      "mitigation": "Upgrade self-managed GitLab EE to 19.2.8, 19.3.5 or 19.4.2 or later. Until then, limit who can contribute content that Duo agents read, such as issues, merge request descriptions and comments, in projects where agents run, and review agent sessions and audit logs for commands run under one user's identity but triggered by another user's content.",
      "detectedByAnomity": true
    }
  }
}