Executive brief
gemini-bridge is a tool that connects AI agents to Google's Gemini AI. A security flaw allowed the tool to read any file on the host system—such as passwords, SSH keys, or configuration files—if a specific command was used with a malicious file path. This could lead to the unauthorized exposure of sensitive data to the AI model and its operators.
Technical details
A path traversal vulnerability (CWE-22) exists in the 'consult_gemini_with_files' tool of gemini-bridge when used in 'inline' mode. The component failed to validate that file paths provided in the 'files' argument were confined to the designated working directory, allowing the use of absolute paths, '..' sequences, or symlinks to access files outside the intended scope. Because the caller also controls the query sent to the Gemini CLI, the contents of these files are echoed back in the AI's response, resulting in an arbitrary local file read. The issue was addressed in version 1.3.1 by hardening path resolution to resolve symlinks and enforcing directory confinement via Path.relative_to.
Affected products
- eLyiN gemini-bridge >= 1.0.0, < 1.3.1
Timeline
- 2026-06-09: patched: Fixed in version 1.3.1
- 2026-07-31: disclosed: CVE-2026-54785 published