Skip to content
CVE PROGRAM SOURCE RECORD10.0 Critical

CVE-2026-12537

Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GoogleCloud

Description

Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously crafted .gemini/.env file.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Google Cloud Gemini CLI

Default version status: unaffected

  • 0 to < 0.39.1affected

Google Cloud run-gemini-cli GitHub Action

Default version status: unaffected

  • 0 to < 0.1.22affected

References