# CVE-2026-96893: CVE-2026-96893: Crafted Content in GitLab Duo Agent Platform Instructions Could Run Commands Attributed to Other Users (CVSS 7.3)

> CVE-2026-96893 is a high-severity prompt injection issue (CVSS 7.3) in GitLab EE, an AI agent. Affected: GitLab EE 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 (Duo Agent Platform).. Fixed in 19.2.8.

- **Canonical URL:** https://catalog.anomity.ai/vuln/cve-2026-96893
- **Aliases:** ti-149
- **Severity:** high
- **CVSS:** 7.3
- **Attack type:** Prompt injection
- **Component:** GitLab EE (AI agent)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-10-13
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/cve-2026-96893

## Summary

NVD published CVE-2026-96893 on 13 October 2026, with GitLab as CNA and a CVSS 3.1 score of 7.3, referencing GitLab's 19.4.2 patch release. In GitLab EE 19.1 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2, an authenticated user could, under certain conditions, inject specially crafted content into AI agent instructions in the Duo Agent Platform, because special elements were not neutralized when the AI conversation context was built. That could cause command execution attributed to other users. GitLab has not published further technical detail beyond work item 607968, and no exploitation has been reported.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| GitLab EE 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 (Duo Agent Platform). | 19.2.8 |

## Am I affected by CVE-2026-96893?

You are affected if you run GitLab EE 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 (Duo Agent Platform).. Versions 19.2.8 and later include the fix.

## How do I fix CVE-2026-96893?

Upgrade self-managed GitLab EE to 19.2.8, 19.3.5 or 19.4.2 or later. Until then, limit who can contribute content that Duo agents read, such as issues, merge request descriptions and comments, in projects where agents run, and review agent sessions and audit logs for commands run under one user's identity but triggered by another user's content.

## How do I find every machine running GitLab EE?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run GitLab EE and which version, then enforce a policy on it.

## References

- cve: https://nvd.nist.gov/vuln/detail/CVE-2026-96893

## Related vulnerabilities

- [cryptographic-context-injection-an-encrypted-web-page-got-github](https://catalog.anomity.ai/vuln/cryptographic-context-injection-an-encrypted-web-page-got-github) — medium
- [manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction](https://catalog.anomity.ai/vuln/manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction) — high
- [salesbleed-zero-click-data-exfiltration-from-salesforce-agentforce-via](https://catalog.anomity.ai/vuln/salesbleed-zero-click-data-exfiltration-from-salesforce-agentforce-via) — high
- [CVE-2026-24301](https://catalog.anomity.ai/vuln/cve-2026-24301) — high
- [ghostjacking-a-firewall-block-log-is-an-injection-channel-because-the](https://catalog.anomity.ai/vuln/ghostjacking-a-firewall-block-log-is-an-injection-channel-because-the) — high
- [rovoblast-one-link-makes-atlassian-rovo-exfiltrate-jira-and-confluence](https://catalog.anomity.ai/vuln/rovoblast-one-link-makes-atlassian-rovo-exfiltrate-jira-and-confluence) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=cve-2026-96893