VulnerabilityPublished 30 Apr 2026

Critical Gemini CLI Flaw Enabled Host Code Execution, Supply Chain Attacks

Source SecurityWeek

Severity

Critical

Rated by Threat Radar

Data as of 30 Apr 2026, 12:36 UTC

What to do

AI-suggested

Google has released official patches for Gemini CLI and the associated 'run-gemini-cli' GitHub Action to remediate this vulnerability. Users and organizations should apply these updates promptly to eliminate the risk of arbitrary code execution. Since this is not a cloud-hosted service, remediation depends on patching the affected software versions. Patch status is confirmed by the vendor advisory.

Description

A critical remote code execution vulnerability was discovered in Gemini CLI, an open source AI agent for terminal access to Gemini. The flaw allowed an attacker to plant malicious configurations in the workspace folder, causing the AI agent to execute arbitrary commands on the host before sandbox initialization. This could lead to unauthorized access to secrets, credentials, and source code accessible by the workflow. The vulnerability also posed a risk of supply chain attacks within CI/CD pipelines by leveraging the execution privileges of trusted contributors. Google has patched this vulnerability in Gemini CLI and the related GitHub Action. No known exploits in the wild have been reported.

Impact

Successful exploitation allows an unprivileged attacker to execute arbitrary code on the host running Gemini CLI, gaining access to sensitive information such as tokens, credentials, and source code available to the workflow. This elevates the risk of lateral movement within affected environments and enables supply chain attacks in CI/CD pipelines by compromising developer workflows. No evidence of exploitation in the wild has been reported to date.

Summary

Researchers at Novee Security identified a critical vulnerability in Gemini CLI where the tool automatically trusted and loaded agent configurations from the current workspace folder without sandboxing or human approval. An attacker able to place a malicious configuration file in this folder could trigger arbitrary command execution on the host system before sandbox initialization. This flaw enables code execution with the privileges of the workflow, potentially exposing secrets, credentials, and source code. In CI/CD environments, this could facilitate supply chain attacks by abusing the trusted execution context of AI coding agents. Google has issued patches for Gemini CLI and the 'run-gemini-cli' GitHub Action to address this issue.

References

securityweek.com/critical-gemini-cli-flaw-enabled-host-code-execution-supply-chain-attacks/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 30 Apr 2026, 12:36 UTC

References

Community reviews