NewsAgency

Critical Google Gemini CLI Flaw Lets Attackers Execute Code on Headless CI Platforms

2 dakika okuma süresi

CVE-2026-12537 — Critical RCE in Google Gemini CLI and run-gemini-cli GitHub Action

CVE ID: CVE-2026-12537
GHSA: GHSA-wpqr-6v78-jr5g
Published: 2026-06-24
CVSS v4 Score: 10.0 (Critical)

Description

Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution via a maliciously crafted .gemini/.env file.

Affected Products

  • Google Cloud Gemini CLI (@google/gemini-cli): versions prior to 0.39.1
  • run-gemini-cli GitHub Action: versions prior to 0.1.22

Technical Details

In previous versions, Gemini CLI running in CI environments (headless mode) automatically trusted workspace folders for the purpose of loading configuration and environment variables. This is potentially risky in situations where Gemini CLI runs on untrusted folders in headless mode (e.g. CI workflows that review user-submitted pull requests). If used with untrusted directory contents, this could lead to remote code execution via malicious environment variables in the local .gemini/ directory.

In version 0.39.1, the Gemini CLI policy engine now evaluates tool allowlisting under --yolo mode. As a result, some workflows that previously depended on this behavior may fail silently unless tool allowlists are modified to fit the task.

The critical failure is that the workspace trust safeguard — normally a human-in-the-loop checkpoint in interactive environments — was silently resolved in favor of whatever content occupied the workspace whenever the tool ran without a terminal attached.

Remediation

Patched versions:

  • @google/gemini-cli version 0.39.1 or 0.40.0-preview.3
  • run-gemini-cli GitHub Action version 0.1.22

Organizations running Gemini CLI in CI/CD pipelines should:

  • Upgrade immediately to patched versions
  • Avoid setting GEMINI_TRUST_WORKSPACE to true unless inputs are fully trusted
  • Harden workflows processing untrusted inputs (PRs from external contributors, forks) without workspace trust

References

Grafik Görünümü