Executive brief
gemini-mcp-tool is a utility that allows AI assistants to interact with the Google Gemini CLI for analyzing large codebases. A vulnerability in this tool allows a remote attacker to execute unauthorized commands on the underlying system without needing a password. This could lead to a complete takeover of the service account, potentially exposing sensitive data or disrupting operations.
Technical details
An OS command injection vulnerability exists in gemini-mcp-tool within the execAsync method. The root cause is the lack of proper validation or neutralization of user-supplied strings before they are passed to a system call. A remote, unauthenticated attacker can exploit this by providing specially crafted input (such as through prompt quoting or @file exfiltration techniques) to execute arbitrary commands in the context of the service account. The vulnerability is addressed in version 1.1.6.
Affected products
- jamubc gemini-mcp-tool >= 1.1.2, < 1.1.6
Timeline
- 2026-01-23: disclosed
- 2026-01-23: advisory: Original GHSA-28qq-5f47-r5x2 published
- 2026-06-18: patched: Version 1.1.6 released