Gemini CLI, an open source AI agent interfacing with Google's Gemini AI, contained a critical security flaw where its –yolo mode bypassed tool allowlists, allowing arbitrary command execution. Attackers could exploit this by injecting malicious prompts into public GitHub issues, which the AI agent would automatically process and execute commands from, leading to extraction of internal secrets and repository takeover. This could result in supply chain attacks by pushing malicious code to the main branch, affecting all downstream users. The vulnerability also included a trust issue in headless mode that allowed unauthorized access to workspace configurations and secrets in CI environments. Google released Gemini CLI version 0.39.1 and updated the run-gemini-cli GitHub Action on April 24, 2026, to remediate these issues.

Successful exploitation could lead to full compromise of the Gemini CLI repository, allowing attackers to push arbitrary code to the main branch and thereby compromise all downstream users relying on the software. Attackers could also extract internal secrets from build environments and gain full write access tokens to repositories. The trust issue in headless mode could expose credentials, secrets, and source code across continuous integration workflows, increasing the risk of supply chain attacks. No known active exploitation has been reported.

Google has released an official fix in Gemini CLI version 0.39.1 that enforces tool allowlisting in –yolo mode and addresses the trust issue in headless mode. Users and organizations should update to this version immediately to mitigate the vulnerability. The run-gemini-cli GitHub Action has also been updated and should be applied. Since this is not a cloud service, patching the client software is required. Patch status is confirmed by the vendor advisory.