Executive brief
Google Gemini CLI and the run-gemini-cli GitHub Action are command-line tools used to interact with Google's Gemini AI in automated environments like CI/CD pipelines. An unprivileged attacker can execute arbitrary code on the host system before containerization by crafting a malicious .gemini/.env configuration file, potentially compromising entire CI/CD workflows and any credentials or code they process.
Technical details
The vulnerability is an OS command injection (CWE-78) and improper input validation (CWE-20) in the container launcher component. The root cause is that Gemini CLI in headless/CI mode automatically trusted workspace folders and loaded environment variables from .gemini/.env files without proper neutralization of shell metacharacters. An attacker can exploit this by submitting a malicious .env file (e.g., via a pull request in a GitHub Actions workflow) to achieve pre-sandbox host-level code execution. The attack vector is local/adjacent with low complexity and requires only that the tool process untrusted directory contents in headless mode. Patches are available in version 0.39.1 for Gemini CLI and 0.1.22 for the GitHub Action, which enforce explicit folder trust and remove automatic processing of configuration in untrusted environments.
Affected products
- Google Gemini CLI < 0.39.1
- Google run-gemini-cli < 0.1.22
Timeline
- 2026-04-24: disclosed: Primary advisory GHSA-wpqr-6v78-jr5g published
- 2026-04-24: patched: Gemini CLI 0.39.1 and 0.40.0-preview.3; run-gemini-cli 0.1.22 released
- 2026-06-24: disclosed: Duplicate advisory GHSA-jj69-4grx-fqj5 published
- 2026-09-24: other: Duplicate advisory withdrawn