Threats affecting pkg:github/atxp-dev/atxp

ATXP Gemini CLI extension versions up to 1.0.0 contain an OS command injection vulnerability in the runAtxp() function. This flaw allows attackers to execute arbitrary shell commands by injecting special shell substitution syntax into unsanitized parameters such as message_id, subject, or query. The injection can be triggered via crafted email or SMS content, leading to command execution with the privileges of the user running the CLI extension.