# CVE-2026-12537: Google Gemini CLI OS command injection in headless CI environments

Source: https://junglewise.ai/threats/cve-2026-12537-google-gemini-cli-os-command-injection-in-headless-ci  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-24. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-12537 · Severity: critical · CVSS 10 · Published 2026-06-24

Google Gemini CLI and its associated GitHub Action are tools used to integrate AI capabilities into software development workflows and automated pipelines. A security flaw allowed these tools to automatically trust and execute configuration files found in a project's directory, even in automated environments like GitHub Actions. An attacker could exploit this by submitting a malicious pull request containing a specially crafted configuration file, allowing them to execute arbitrary commands on the build server and potentially compromise sensitive credentials or source code.

Technologies: [Google Gemini CLI](https://junglewise.ai/threats/technologies/gemini-cli). Vendors: [GitHub Actions](https://junglewise.ai/threats/vendors/actions), [Google](https://junglewise.ai/threats/vendors/google), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-12537 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12537 being exploited in the wild.

**How severe is CVE-2026-12537?** Critical severity, with a CVSS score of 10, published 24 June 2026.

**Which products and versions are affected?** google-github-actions/run-gemini-cli (GitHub Actions) < 0.1.22, ECOSYSTEM:introduced=0,fixed=0.1.22|GIT:introduced=0,fixed=f77273f4c914e4bf38440cf36a0369cb64a37489; Google Gemini CLI < 0.39.1, < 0.40.0-preview.3; Google run-gemini-cli GitHub Action < 0.1.22; @google/gemini-cli (npm) < 0.39.1, SEMVER:introduced=0,fixed=0.39.1.

**Is there a fix for CVE-2026-12537?** Yes. google-github-actions/run-gemini-cli (GitHub Actions): upgrade to 0.1.22 or later; @google/gemini-cli (npm): upgrade to 0.39.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12537 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-12537?** Check whether you run google-github-actions/run-gemini-cli (GitHub Actions), Google Gemini CLI, Google run-gemini-cli GitHub Action or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- google-github-actions/run-gemini-cli (GitHub Actions): upgrade to 0.1.22 or later
- @google/gemini-cli (npm): upgrade to 0.39.1 or later

  ```sh
  npm install @google/gemini-cli@0.39.1
  ```


## Technical details

A vulnerability exists in the container launcher of Google Gemini CLI and the run-gemini-cli GitHub Action due to improper neutralization of OS commands. In headless (non-interactive) modes, such as CI/CD pipelines, the CLI automatically trusted workspace folders and processed configuration files (e.g., .gemini/.env) without explicit user consent. An attacker can exploit this by placing a malicious .env file in a repository; when a CI workflow (like a pull request check) runs the Gemini CLI on that untrusted content, it leads to pre-sandbox host-level code execution. Additionally, the CLI's '--yolo' mode previously bypassed tool allowlists, which could be exploited via prompt injection. Patches in Gemini CLI 0.39.1 and GitHub Action 0.1.22 introduce a breaking change requiring explicit workspace trust via the GEMINI_TRUST_WORKSPACE environment variable.

## Affected products

- Google Cloud Gemini CLI (@google/gemini-cli) < 0.39.1, < 0.40.0-preview.3
- Google Cloud run-gemini-cli GitHub Action < 0.1.22

## Identifiers

- CVE-2026-12537
- GHSA-wpqr-6v78-jr5g

## Timeline

- 2026-04-24: advisory: GitHub Security Advisory GHSA-wpqr-6v78-jr5g published
- 2026-06-24: disclosed: CVE-2026-12537 published to NVD

## References

- [https://github.com/google-github-actions/run-gemini-cli/security/advisories/GHSA-wpqr-6v78-jr5g](https://github.com/google-github-actions/run-gemini-cli/security/advisories/GHSA-wpqr-6v78-jr5g)

## Related threats

- [Google Gemini CLI arbitrary code execution via .env override](https://junglewise.ai/threats/cve-2026-13745-google-gemini-cli-arbitrary-code-execution-via-env-override)
- [Google Gemini CLI OS command injection in container launcher](https://junglewise.ai/threats/google-gemini-cli-os-command-injection-in-container-launcher-f7bccc96)