On April 24, 2026, Google published advisory GHSA-wpqr-6v78-jr5g disclosing a critical remote code execution vulnerability in @google/gemini-cli, rated CVSS 10.0. The vulnerability affects all versions before 0.39.1 (stable) and 0.40.0-preview.3 (preview), and google-github-actions/run-gemini-cli before 0.1.22.
Attack vector: malicious .gemini/.env configuration in untrusted workspaces on headless CI platforms achieves pre-sandbox host-level code execution.
Organizations running Gemini CLI in CI pipelines processing external pull requests should treat this as requiring immediate remediation. Upgrade @google/gemini-cli to 0.39.1+ and pin google-github-actions/run-gemini-cli to 0.1.22+.
Additional finding: under --yolo mode, fine-grained tool restrictions in ~/.gemini/settings.json were not enforced as expected — an unqualified run_shell_command entry acted as a wildcard. Google corrected this in 0.39.1.
For untrusted data workflows, do not set GEMINI_TRUST_WORKSPACE=true. For trusted internal workflows, explicit trust configuration may be set after hardening.