GitLab EE EUVD-2026-98213

Requires (1) an authenticated GitLab EE account with permission to write content that feeds AI-agent conversation context (PR:L), (2) the AI agent / AI conversation feature actually enabled and in use in the instance, and (3) a separate victim user invoking that AI agent so the injected instructions are processed (UI:R). Exploitation is limited to EE versions 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2; it is 'under certain conditions' per the vendor, implying it is not universal across all configurations. These factors - mandatory authentication, dependency on the AI feature being deployed, and required victim interaction - substantially narrow realistic exploitation despite the network attack vector.

This is a moderate-priority issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, base 7.3) indicates a network-reachable flaw that is low-complexity to trigger but requires an authenticated account (PR:L) AND victim user interaction (UI:R) - a legitimate user must engage with the poisoned AI agent context for the payload to fire. CWE-1427 (improper neutralization of input used in LLM prompt construction) confirms this is an AI prompt-injection class issue, consistent with the description's 'command execution attributed to other users.' No EPSS score, CISA KEV listing, or POC was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the two authentication/interaction preconditions make mass automated exploitation unlikely. Note a tension worth flagging: the Tags label this 'Code Injection' and the description mentions 'command execution,' but CWE-1427 and the 'AI conversation context' language point to LLM instruction injection, not traditional OS/code injection - the C:H/I:H impact likely reflects actions the AI agent performs on behalf of the victim rather than direct shell execution; verify the precise impact boundary with GitLab. Absence of EPSS/KEV data should not be read as safety, only as missing signal.

An authenticated GitLab EE user with the ability to contribute content (e.g., issues, comments, or merge-request text consumed by an AI agent) embeds specially crafted instructions into that content. When a different user's AI agent later builds its conversation context from this data, the injected instructions execute as if issued by that victim user, causing unintended actions attributed to them. No public exploit code was identified at time of analysis, and the attack depends on the victim invoking the AI agent (UI:R).