CVE-2026-12537: Google Gemini CLI OS command injection in headless CI environments

CVE-2026-12537 · Severity: critical · CVSS 10 · Published 2026-06-24

Google Gemini CLI and its associated GitHub Action are tools used to integrate AI capabilities into software development workflows and automated pipelines. A security flaw allowed these tools to automatically trust and execute configuration files found in a project's directory, even in automated environments like GitHub Actions. An attacker could exploit this by submitting a malicious pull request containing a specially crafted configuration file, allowing them to execute arbitrary commands on the build server and potentially compromise sensitive credentials or source code.

Technologies: Google Gemini CLI. Vendors: GitHub Actions, Google, npm.

Quick answers

Is CVE-2026-12537 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-12537 being exploited in the wild.
How severe is CVE-2026-12537?
Critical severity, with a CVSS score of 10, published 24 June 2026.
Which products and versions are affected?
google-github-actions/run-gemini-cli (GitHub Actions) < 0.1.22, ECOSYSTEM:introduced=0,fixed=0.1.22|GIT:introduced=0,fixed=f77273f4c914e4bf38440cf36a0369cb64a37489; Google Gemini CLI < 0.39.1, < 0.40.0-preview.3; Google run-gemini-cli GitHub Action < 0.1.22; @google/gemini-cli (npm) < 0.39.1, SEMVER:introduced=0,fixed=0.39.1.
Is there a fix for CVE-2026-12537?
Yes. google-github-actions/run-gemini-cli (GitHub Actions): upgrade to 0.1.22 or later; @google/gemini-cli (npm): upgrade to 0.39.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12537 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-12537?
Check whether you run google-github-actions/run-gemini-cli (GitHub Actions), Google Gemini CLI, Google run-gemini-cli GitHub Action or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • google-github-actions/run-gemini-cli (GitHub Actions): upgrade to 0.1.22 or later
  • @google/gemini-cli (npm): upgrade to 0.39.1 or later
    npm install @google/gemini-cli@0.39.1

Technical details

A vulnerability exists in the container launcher of Google Gemini CLI and the run-gemini-cli GitHub Action due to improper neutralization of OS commands. In headless (non-interactive) modes, such as CI/CD pipelines, the CLI automatically trusted workspace folders and processed configuration files (e.g., .gemini/.env) without explicit user consent. An attacker can exploit this by placing a malicious .env file in a repository; when a CI workflow (like a pull request check) runs the Gemini CLI on that untrusted content, it leads to pre-sandbox host-level code execution. Additionally, the CLI's '--yolo' mode previously bypassed tool allowlists, which could be exploited via prompt injection. Patches in Gemini CLI 0.39.1 and GitHub Action 0.1.22 introduce a breaking change requiring explicit workspace trust via the GEMINI_TRUST_WORKSPACE environment variable.

Affected products

  • Google Cloud Gemini CLI (@google/gemini-cli) < 0.39.1, < 0.40.0-preview.3
  • Google Cloud run-gemini-cli GitHub Action < 0.1.22

Identifiers

  • CVE-2026-12537
  • GHSA-wpqr-6v78-jr5g

Timeline

  • 2026-04-24: advisory: GitHub Security Advisory GHSA-wpqr-6v78-jr5g published
  • 2026-06-24: disclosed: CVE-2026-12537 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.