A prompt template that was not a sandbox
GitLab has patched a critical flaw in its AI Gateway that let an authenticated user break out of a prompt template and run arbitrary commands on the host underneath. The vulnerability, CVE-2026-90970, carries a CVSS score of 9.9.
The mechanism is the part worth reading. The AI Gateway processes custom flow configurations through Jinja2-style template placeholders. Because the user-supplied configuration data was not properly neutralised, an attacker with Duo Agent Platform access could craft a flow configuration that manipulated the template engine and escaped the sandbox it was supposed to run inside. GitLab classifies it under CWE-1336, improper neutralisation of special elements in a template engine.
Security Affairs reported that the flaw affects AI Gateway versions 18.1.6 through 19.2.3, 19.3.0 through 19.3.1, and 19.4.0. The fixes are in 19.2.4, 19.3.2 and 19.4.1, published on 2 October. It was reported through HackerOne by a researcher using the handle invisiblemeerkat.
Who has to act
Self-hosted deployments are the exposed ones. GitLab-hosted gateways were already patched, so GitLab.com and GitLab Dedicated customers, and self-managed customers who use the hosted gateway, have nothing to do. Anyone running their own AI Gateway has to upgrade.
The attack is not unauthenticated. It requires a valid account with access to the Duo Agent Platform, which narrows the exposure considerably — an insider, a compromised developer account, or any instance where self-service signup hands out Duo access. GitLab reported no evidence of exploitation in the wild, and CISA’s assessment added to the CVE record on 2 October lists exploitation as none.
The shape of the problem
A template engine that interpolates untrusted strings is an old vulnerability class with a new surface. Server-side template injection has been understood for a decade; what is new is that the untrusted string is now an agent flow configuration, written by a user who is nominally allowed to configure the agent.
That is the structural issue across the category. AI gateways exist to sit between a developer and a model, and their value comes from letting users define prompts, flows and tool configurations. Every one of those definitions is user input reaching an interpreter, and a prompt template is not a security boundary unless it was built as one.
What to watch is how many comparable products have the same shape. GitLab’s is the one with a CVE number this week; the pattern of accepting user-authored flow configuration into a template engine is not unique to it.
