Read the docs
TI-2026-10756 Aliases CVE-2026-12537GHSA-wpqr-6v78-jr5g

Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows

Priority MEDIUM 48CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution, Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78 and CWE-200.

Summary

Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously crafted .gemini/.env file.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00212 11th percentileScored 2026-11-07
Fix Fixed Gemini CLI (Google Cloud): 0.39.1run-gemini-cli GitHub Action (Google Cloud): 0.1.22+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GoogleGemini CLIbefore 0.39.10.39.1Patch availableCNA
Googlerun-gemini-cli GitHub Actionbefore 0.1.220.1.22Patch availableCNA
—@google/gemini-cli (npm)before 0.39.10.39.1Patch availableGHSA-wpqr-6v78-jr5g
—@google/gemini-cli (npm)0.40.0-preview.2 to before 0.40.0-preview.30.40.0-preview.3Patch availableGHSA-wpqr-6v78-jr5g
—google-github-actions/run-gemini-cli (GitHub Actions)before 0.1.220.1.22Patch availableGHSA-wpqr-6v78-jr5g
  • Gemini CLI VendorGoogle Affected before 0.39.1 Fixed in 0.39.1 Patch available CNA
  • run-gemini-cli GitHub Action VendorGoogle Affected before 0.1.22 Fixed in 0.1.22 Patch available CNA
  • @google/gemini-cli (npm) Vendor— Affected before 0.39.1 Fixed in 0.39.1 Patch available GHSA-wpqr-6v78-jr5g
  • @google/gemini-cli (npm) Vendor— Affected 0.40.0-preview.2 to before 0.40.0-preview.3 Fixed in 0.40.0-preview.3 Patch available GHSA-wpqr-6v78-jr5g
  • google-github-actions/run-gemini-cli (GitHub Actions) Vendor— Affected before 0.1.22 Fixed in 0.1.22 Patch available GHSA-wpqr-6v78-jr5g

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:google:gemini-cli:*:*:*:*:*:node.js:*:*before 0.39.1VulnerableGoogle
cpe:2.3:a:google:gemini-cli:0.40.0:preview2:*:*:*:node.js:*:*0.40.0 preview2VulnerableGoogle
cpe:2.3:a:google:run-gemini-cli:*:*:*:*:*:*:*:*before 0.1.22VulnerableGoogle
  • cpe:2.3:a:google:gemini-cli:*:*:*:*:*:node.js:*:* Versions before 0.39.1 Vulnerable ·Google
  • cpe:2.3:a:google:gemini-cli:0.40.0:preview2:*:*:*:node.js:*:* Versions 0.40.0 preview2 Vulnerable ·Google
  • cpe:2.3:a:google:run-gemini-cli:*:*:*:*:*:*:*:* Versions before 0.1.22 Vulnerable ·Google

Remediation

  • Fix · CNA Gemini CLI (Google Cloud) Fixed in 0.39.1
  • Fix · CNA run-gemini-cli GitHub Action (Google Cloud) Fixed in 0.1.22
  • Fix · GHSA-wpqr-6v78-jr5g @google/gemini-cli (npm) Fixed in 0.39.1 Advisory →
  • Fix · GHSA-wpqr-6v78-jr5g @google/gemini-cli (npm) Fixed in 0.40.0-preview.3 Advisory →
  • Fix · GHSA-wpqr-6v78-jr5g google-github-actions/run-gemini-cli (GitHub Actions) Fixed in 0.1.22 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-12537
  2. 2026-10-03 Alias added: GHSA-wpqr-6v78-jr5g

References

Patch 1

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences