CVE-2026-90970

GitLab released AI Gateway versions 19.2.4, 19.3.2, and 19.4.1 to fix a critical prompt-template sandbox escape tracked as CVE-2026-90970 with a CVSS score of 9.9 out of 10, disclosed on October 2. A …

GitLab patched a critical remote-code-execution flaw, tracked as CVE-2026-90970, in its AI Gateway service that could have let attackers run arbitrary commands on vulnerable instances, including users…