GitLab Patched a CVSS 9.9 RCE in Its AI Gateway — Patch Guide for Self-Hosted Agent Builders
GitLab disclosed CVE-2026-90970 (CVSS 9.9) on Oct 2, 2026: a prompt-template sandbox escape in the self-hosted AI Gateway. Here's who must patch and h
🎯 Vulnerability: Remote Code Execution (RCE)
💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.