Researchers at Novee Security identified a critical vulnerability in Gemini CLI where the tool automatically trusted and loaded agent configurations from the current workspace folder without sandboxing or human approval. An attacker able to place a malicious configuration file in this folder could trigger arbitrary command execution on the host system before sandbox initialization. This flaw enables code execution with the privileges of the workflow, potentially exposing secrets, credentials, and source code. In CI/CD environments, this could facilitate supply chain attacks by abusing the trusted execution context of AI coding agents. Google has issued patches for Gemini CLI and the 'run-gemini-cli' GitHub Action to address this issue.

Successful exploitation allows an unprivileged attacker to execute arbitrary code on the host running Gemini CLI, gaining access to sensitive information such as tokens, credentials, and source code available to the workflow. This elevates the risk of lateral movement within affected environments and enables supply chain attacks in CI/CD pipelines by compromising developer workflows. No evidence of exploitation in the wild has been reported to date.

Google has released official patches for Gemini CLI and the associated 'run-gemini-cli' GitHub Action to remediate this vulnerability. Users and organizations should apply these updates promptly to eliminate the risk of arbitrary code execution. Since this is not a cloud-hosted service, remediation depends on patching the affected software versions. Patch status is confirmed by the vendor advisory.