Executive brief
Google Gemini CLI and its associated GitHub Action are tools used to integrate AI capabilities into software development workflows and automated pipelines. A security flaw allowed these tools to automatically trust and execute configuration files found in a project's directory, even in automated environments like GitHub Actions. An attacker could exploit this by submitting a malicious pull request containing a specially crafted configuration file, allowing them to execute arbitrary commands on the build server and potentially compromise sensitive credentials or source code.
Technical details
A vulnerability exists in the container launcher of Google Gemini CLI and the run-gemini-cli GitHub Action due to improper neutralization of OS commands. In headless (non-interactive) modes, such as CI/CD pipelines, the CLI automatically trusted workspace folders and processed configuration files (e.g., .gemini/.env) without explicit user consent. An attacker can exploit this by placing a malicious .env file in a repository; when a CI workflow (like a pull request check) runs the Gemini CLI on that untrusted content, it leads to pre-sandbox host-level code execution. Additionally, the CLI's '--yolo' mode previously bypassed tool allowlists, which could be exploited via prompt injection. Patches in Gemini CLI 0.39.1 and GitHub Action 0.1.22 introduce a breaking change requiring explicit workspace trust via the GEMINI_TRUST_WORKSPACE environment variable.
Affected products
- Google Cloud Gemini CLI (@google/gemini-cli) < 0.39.1, < 0.40.0-preview.3
- Google Cloud run-gemini-cli GitHub Action < 0.1.22
Timeline
- 2026-04-24: advisory: GitHub Security Advisory GHSA-wpqr-6v78-jr5g published
- 2026-06-24: disclosed: CVE-2026-12537 published to NVD