GitLab AI Gateway prompt template sandbox can be escaped via a specially crafted flow configuration by an authenticated user with Duo Agent Platform access, leading to arbitrary command execution on the AI Gateway. Affected: 18.1.6 to 19.2.4, 19.3 to 19.3.2, 19.4 to 19.4.1. Update to 19.2.4, 19.3.2, or 19.4.1 to mitigate.