Executive brief
gemini-mcp-tool is an npm package that enables AI assistants to interact with Google Gemini's CLI for large file analysis. A remote code execution vulnerability in the execAsync method allows unauthenticated attackers to inject arbitrary OS commands via unsanitized user input, potentially leading to full system compromise and data exfiltration.
Technical details
The vulnerability exists in the execAsync method of gemini-mcp-tool, which fails to properly validate user-supplied strings before passing them to system call execution functions (CWE-78: Improper Neutralization of Special Elements used in an OS Command). The flaw allows remote attackers without authentication to inject arbitrary OS commands through prompt quoting mechanisms and @file references. An attacker can leverage this to achieve code execution in the context of the service account, potentially leading to unauthorized file access, system compromise, and exfiltration of sensitive data. The vulnerability affects versions 1.1.2 through 1.1.5; a patch is available in version 1.1.6 and later.
Affected products
- jamubc gemini-mcp-tool 1.1.2 through 1.1.5
Timeline
- 2026-01-09: disclosed: ZDI coordinated public release of advisory
- 2026-01-23: patched: Patch available in version 1.1.6
- 2026-06-18: other: Advisory withdrawn as duplicate of GHSA-4h5r-5jm8-jxjm