Gemini MCP Tool Zero-Day Allows Remote Attackers to Execute Arbitrary Code

A critical zero-day vulnerability in the Gemini MCP Tool, a utility often used to manage interactions within the Gemini ecosystem.

The security flaw allows unauthenticated remote attackers to execute arbitrary code on affected installations. Because the vendor has not yet released a patch, this remains an active zero-day threat.

The vulnerability, tracked as CVE-2026-0755, carries a CVSS score of 9.8, classifying it as critical.

The severity stems from the fact that no user interaction or prior authentication is required to trigger the exploit. An attacker needs network access to the target system to fully compromise it.

Technical Analysis of the Flaw

The root cause of the vulnerability lies in the implementation of the execAsync method in the Gemini MCP Tool.

This function is designed to handle asynchronous command execution, but it fails to sanitize user-supplied input strings properly.

When the application processes a request involving this method, it passes the input directly to a system call without sufficient validation. Attackers can inject malicious commands into this input stream.

Once processed, the system executes these commands with the same privileges as the service account running the tool.

This effectively grants the attacker control over the underlying operating system, enabling them to install malware, exfiltrate data, or disrupt services.

The disclosure timeline reveals a significant delay in the vendor’s response. ZDI originally submitted the vulnerability report to the vendor on July 25, 2025. Despite follow-up attempts in November, the vendor provided no effective resolution.

Consequently, the vendor in December of their intention to publish the case as a zero-day advisory, which occurred on January 9, 2026.

Currently, there is no official patch available to fix CVE-2026-0755. The primary mitigation strategy is to restrict network access to the Gemini MCP Tool.

Administrators should ensure the service is not exposed to the public internet and is accessible only via trusted internal networks or VPNs.

Organizations using the Gemini MCP Tool are urged to isolate the application until a security update is released immediately. Security teams should monitor network traffic for suspicious calls targeting the execAsync function.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.