CVE-2026-12537
Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously crafted .gemini/.env file.
- Score
- CVSS 4.0 10.0 Critical
- Status
- Analyzed - f45cbf4e-4146-4068-b7e1-655ffc2c548c
- Published
- 2026-06-24
- Last modified
- 2026-06-24
- Weaknesses
- CWE-20, CWE-78
Affected products
- Gemini-cli (Google)
- Run-gemini-cli (Google)
- Gemini Cli (Google Cloud)
- Run-gemini-cli Github Action (Google Cloud)
References
- https://github.com/google-github-actions/run-gemini-cli/security/advisories/GHSA-wpqr-6v78-jr5g
