Threats tagged 'ghsa-w542-83fj-2ghf'

ATXP Gemini CLI extension versions through 1.0.0 contain an OS command injection vulnerability in the runAtxp() function. This flaw allows attackers to execute arbitrary shell commands by injecting malicious input into unsanitized parameters such as message_id, subject, or query. The injection can be triggered via crafted email or SMS content using shell substitution syntax like $() or backticks, resulting in command execution with the privileges of the user running the CLI extension.