Source: thehackernews.com
A critical vulnerability (CVSS 9.9) was discovered in GitLab's AI Gateway, which serves as the connector between GitLab instances and AI models. The flaw allows a logged-in user with Duo Agent Platform access to execute arbitrary commands on the gateway under certain conditions. Only organizations self-hosting their own AI Gateway are affected; GitLab-hosted instances are not impacted. GitLab has released patches in gateway versions 19.2.4, 19.3.2, and 19.4.1 to address the vulnerability. Affected organizations are urged to update immediately to mitigate the risk of unauthorized command execution on their infrastructure.
