Google Gemini CLI OS command injection in container launcher

Severity: high · CVSS 7.8 · Published 2026-06-24

Google Gemini CLI and the run-gemini-cli GitHub Action are command-line tools used to interact with Google's Gemini AI in automated environments like CI/CD pipelines. An unprivileged attacker can execute arbitrary code on the host system before containerization by crafting a malicious .gemini/.env configuration file, potentially compromising entire CI/CD workflows and any credentials or code they process.

Technologies: Google Gemini CLI. Vendors: GitHub Actions, Google.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 7.8, published 24 June 2026.
Which products and versions are affected?
google-github-actions/run-gemini-cli (GitHub Actions) < 0.1.22; Google Gemini CLI < 0.39.1; Google Run-Gemini-Cli < 0.1.22.
Is there a fix for This vulnerability?
A patch was published on 2026-04-24: Gemini CLI 0.39.1 and 0.40.0-preview.3; run-gemini-cli 0.1.22 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network or with local access.
Am I affected?
Check whether you run google-github-actions/run-gemini-cli (GitHub Actions), Google Gemini CLI or Google Run-Gemini-Cli at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an OS command injection (CWE-78) and improper input validation (CWE-20) in the container launcher component. The root cause is that Gemini CLI in headless/CI mode automatically trusted workspace folders and loaded environment variables from .gemini/.env files without proper neutralization of shell metacharacters. An attacker can exploit this by submitting a malicious .env file (e.g., via a pull request in a GitHub Actions workflow) to achieve pre-sandbox host-level code execution. The attack vector is local/adjacent with low complexity and requires only that the tool process untrusted directory contents in headless mode. Patches are available in version 0.39.1 for Gemini CLI and 0.1.22 for the GitHub Action, which enforce explicit folder trust and remove automatic processing of configuration in untrusted environments.

Affected products

  • Google Gemini CLI < 0.39.1
  • Google run-gemini-cli < 0.1.22

Timeline

  • 2026-04-24: disclosed: Primary advisory GHSA-wpqr-6v78-jr5g published
  • 2026-04-24: patched: Gemini CLI 0.39.1 and 0.40.0-preview.3; run-gemini-cli 0.1.22 released
  • 2026-06-24: disclosed: Duplicate advisory GHSA-jj69-4grx-fqj5 published
  • 2026-09-24: other: Duplicate advisory withdrawn

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.