Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

run-gemini-cli lets attacker execute code on host

published 4 months ago
Summary

Older versions of the run‑gemini‑cli tool used in GitHub Actions could be fooled by a specially crafted .gemini/.env file to run commands on the machine that runs the workflow. This means an attacker could execute their own code and potentially take control of the build environment. Upgrade to the newest version of the tool (0.39.1 for the CLI or 0.1.22 for the Action) and only use trusted configuration files.

What to do
  • Update google-github-actions google-github-actions/run-gemini-cli to version 0.1.22.
Affected software
Ecosystem VendorProductAffected versions
GitHub Actions google-github-actions google-github-actions/run-gemini-cli < 0.1.22
Fix: upgrade to 0.1.22
Original advisory text
Duplicate Advisory: Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-wpqr-6v78-jr5g. This link is maintained to preserve external references.

### Original Description
Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously crafted .gemini/.env file.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.9 Critical
Type
CWE-20Improper Input Validation
CWE-78OS Command Injection
Timeline
Published24 Jun 2026
Updated30 Sep 2026
First seen30 Sep 2026
Sources
GHSA-jj69-4grx-fqj5 · OSV
Track software like this
Free during beta