GitLab Releases Emergency Patches for Sandbox Escape Vulnerability in AI Gateway

GitLab disclosed a critical remote code execution vulnerability in its self-hosted AI Gateway that allows authenticated users to bypass sandbox protections through specially crafted flow configurations. The company released patched versions 19.2.4, 19.3.2, and 19.4.1 for customers running their own deployments, while cloud-hosted instances were already secured. The flaw exploits improper handling in the gateway's template engine and requires only basic user privileges plus access to the Duo Agent Platform to trigger.

GitLab's AI Gateway serves as the infrastructure behind GitLab Duo, the company's AI-powered development features used across its cloud and self-managed deployments. The vulnerability affects only customers operating their own gateway instances, while GitLab's centrally hosted service remains unaffected. This creates a bifurcated risk landscape where self-managed users must actively apply patches to versions 19.2.4, 19.3.2, or 19.4.1, while cloud customers gain automatic protection.

The attack surface is constrained by authentication requirements—only users with legitimate Duo Agent Platform access and basic privileges can exploit the flaw through maliciously crafted flow configurations. However, this relatively narrow entry point reflects a broader pattern in AI agent tooling, where input handling vulnerabilities in template engines and argument processing have repeatedly led to command execution, making agent security a recurring challenge in the AI tooling ecosystem.