A maximum-severity vulnerability in Google’s Gemini CLI and the run-gemini-cli A GitHub Action has been publicly disclosed, enabling unprivileged remote attackers to execute arbitrary OS commands on the host before the agent’s sandbox even initializes.
Tracked as CVE-2026-12537 and assigned a perfect CVSS v4 score of 10.0, the flaw puts thousands of CI/CD pipelines at immediate risk of command injection and supply chain compromise.
The security advisory, identified as GHSA-wpqr-6v78-jr5g, was originally published on April 24, 2026, by Google’s security team and later registered in the National Vulnerability Database on June 23, 2026.
Critical Gemini CLI Vulnerability
It was independently discovered by Elad Meged of Novee Security and Dan Lisichkin of Pillar Security, both reporting through Google’s Vulnerability Rewards Program.
Two distinct root causes create the full exploit surface:
Automatic Workspace Trust in Headless Mode (CWE-20, CWE-200): Prior to the patch, Gemini CLI running in CI/CD headless environments automatically trusted any workspace folder and loaded configuration files including .env files inside the .gemini/ directory without requiring explicit authorization.
An attacker submitting a pull request containing a maliciously crafted .gemini/.env file could inject environment variables into the container launcher, achieving pre-sandbox host-level remote code execution.
Tool Allowlist Bypass Under --yolo Mode (CWE-77, CWE-78): When Gemini CLI was invoked in --yolo mode, it entirely ignored fine-grained tool allowlists defined in ~/.gemini/settings.json.
Even a strict allowlist permitting only safe shell commands like run_shell_command(echo) could be bypassed, allowing any arbitrary command to run.
By combining prompt injection via untrusted inputs, such as public GitHub issues, with the AI agent’s execution, attackers could hijack the AI agent’s execution to exfiltrate CI secrets.
Pillar Security demonstrated a four-step exploit: an attacker submits a public GitHub issue with hidden prompt injection instructions, the Gemini-powered triage agent processes it, the injected prompt forces secret exfiltration to an attacker-controlled server.
The stolen token grants full repository write access, enabling malicious code to be pushed directly to the main branch and distributed to every downstream user.
Affected Versions
@google/gemini-cli(npm): versions < 0.39.1 and < 0.40.0-preview.3google-github-actions/run-gemini-cli(GitHub Actions): versions < 0.1.22
Patches and Mitigation
Google released fixes in @google/gemini-cli v0.39.1 and v0.40.0-preview.3, and run-gemini-cli v0.1.22. Security teams must take one of two immediate actions:
- Trusted pipelines (e.g., internal PRs): Set
GEMINI_TRUST_WORKSPACE: 'true'in the workflow environment. - Untrusted pipelines (e.g., public PRs or issues): Follow Google’s official hardening guidance and enforce a strict tool allowlist.
Organizations that pin a specific gemini_cli_version in their workflows must audit and upgrade immediately.
Given the zero-privilege, network-accessible, no-interaction-required attack vector, this vulnerability demands emergency patch priority across all affected CI/CD environments.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
