Executive brief
Gemini CLI is a command-line tool that acts as an AI-powered coding assistant. Prior to version 0.39.1, an attacker can trick a user into running the CLI from a malicious directory containing a .env file that redirects the application's configuration folder, bypassing safety prompts and allowing arbitrary command execution through malicious MCP server configurations.
Technical details
The vulnerability is a directory traversal / configuration hijacking flaw in how Gemini CLI processes environment variables and configuration files. The root cause is that the GEMINI_CLI_HOME environment variable (read from untrusted .env files in the current working directory) is used to redirect the location of the "trusted" user configuration directory. By placing a malicious .env file and corresponding .gemini/settings.json in an untrusted directory, an attacker can disable the folder trust prompt (via security.folderTrust.enabled = false) and inject malicious MCP server commands that execute with the user's privileges. The attack requires only that a victim launch Gemini CLI from an attacker-controlled or attacker-prepared directory; no user interaction beyond running the tool is needed. The vulnerability was patched in version 0.39.1.
Affected products
- Google Gemini CLI prior to 0.39.1
Timeline
- 2026-06-04: disclosed: Vulnerability disclosed on pwned.info
- 2026-04-24: patched: Fix released in version 0.39.1
- 2026-09-10: advisory: CVE-2026-13745 published on NVD