The Novee Security research team disclosed a critical remote code execution vulnerability in Google Gemini CLI and the run-gemini-cli GitHub Action. Google assigned it CVSS 10.0, the maximum severity.
The vulnerability allowed an unprivileged external attacker to force malicious content to load as Gemini configuration, triggering command execution directly on the host system before the agent’s sandbox initialized.
The flaw lived in how Gemini CLI handled workspace trust in non-interactive environments. In headless mode (CI/CD jobs), Gemini CLI automatically trusted the current workspace folder, loading any agent configuration without review, sandboxing, or human approval. An attacker who could place content in a repository workspace — via pull request — could plant configuration that the agent silently trusted and acted on.
Patches are available in @google/gemini-cli 0.39.1 and 0.40.0-preview.3, and google-github-actions/run-gemini-cli 0.1.22.
Version 0.39.1 also enforces tool allowlisting under --yolo mode. Some workflows that previously depended on unrestricted auto-approval may fail unless tool allowlists are explicitly configured.