Threats tagged 'ghsa-2255-3477-vp73'

CVE-2026-13745 is a critical vulnerability in Google Cloud Gemini CLI versions prior to 0.39.1. It allows attackers to achieve arbitrary code execution by tricking users into running the CLI in an untrusted directory. The attack exploits improper input validation where untrusted .env files can override the GEMINI_CLI_HOME environment variable, causing malicious configuration files to be loaded and bypassing folder trust prompts.