CVE-2026-96893 is listed by GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Oct 13, 2026 · Tenable CVE Database

   Detected

   GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing unintended command execution attributed to other users, due to improper neutralization of special elements i

Sources

• CVE.orgVulnerability recordCVE-2026-96893

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-96893

  30-day exploitation probability 0.5%

  first.org
• GitLab Security ReleasesVendor advisoryCVE-2026-96893

  On October 12, 2026, we released versions 19.4.2, 19.3.5, 19.2.8 for GitLab Community Edition (CE) and Enterprise Edition (EE). 19.3.4 had a bug that affected merge request pages when the Ona integration was enabled. This is fixed in 19.3.5. These versions contain important bug a

  docs.gitlab.com
• Tenable CVE DatabaseVulnerability recordCVE-2026-96893

  GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing unintended command execution attributed to other users, due to improper neutralization of special elements i

  tenable.com