CVE-2026-96893
Last modified
CVE-2026-96893 is a high-severity vulnerability rated 7.3/10 on the CVSS scale. GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing unintended command execution attributed to other users, due to improper neutralization of special elements in AI conversation context construction.. EPSS estimates a 0.55% chance of exploitation in the next 30 days.
Description
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing unintended command execution attributed to other users, due to improper neutralization of special elements in AI conversation context construction.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | >= 19.1.0, < 19.2.8 |
| Gitlab | Gitlab | >= 19.3.0, < 19.3.5 |
| Gitlab | Gitlab | >= 19.4.0, < 19.4.2 |
References
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/work_items/607968Issue Tracking
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-96893?
How severe is CVE-2026-96893?
How do I fix CVE-2026-96893?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-96888A BIND resolver that is configured with both a "redirect" zo…7.5
- CVE-2026-96889A flaw was found in librsvg. When processing an SVG document…7.8
- CVE-2026-9689A flaw was found in Keycloak, an open-source identity and ac…4.2
- CVE-2026-96890A Server-Side Request Forgery (SSRF) vulnerability was ident…8.8
- CVE-2026-96891A vulnerability was identified in D-Link DIR-825 3.00b32. Af…9.8
- CVE-2026-96892A flaw has been found in Edimax BR-6428nC 1.16. The impacted…4.3
- CVE-2026-96894The ERP: Complete HR, Accounting & CRM Suite Built for WooCo…7.2
- CVE-2026-96895The WP YouTube Lyte WordPress plugin before 1.7.31 does not …6.8
- CVE-2026-96896The Malcure Malware Shield — Removal, Repair, Monitor WordPr…7.2
- CVE-2026-96897The Optima Express IDX WordPress plugin before 8.7.6 does no…5.3
- CVE-2026-96898A vulnerability was detected in yhx070424 ShopXO up to 2.2.7…7.3
- CVE-2026-96899The Optima Express IDX WordPress plugin before 8.7.6 does no…6.8
Are you affected by CVE-2026-96893?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST