Critical Gemini CLI Vulnerability (CVE-2026-12537) Enables Remote Code Execution via Malicious .env Workspace Trust Bypass

Critical Gemini CLI Vulnerability (CVE-2026-12537) Enables (TL-2026-1206), also tracked as GHSA-wpqr-6v78-jr5g, is a critical-severity software vulnerability scored CVSS 10, first published 2026-07-11. It has no confirmed attribution, affects Google @google/gemini-cli, references 2 CVEs (CVE-2026-12537, CVE-2026-26268), maps to 19 MITRE ATT&CK techniques (T1005, T1059, T1059.004), and is covered by 9 detection rules and 23 indicators of compromise.

Key facts for TL-2026-1206

Threat ID
TL-2026-1206
Also known as
GHSA-wpqr-6v78-jr5g, GHSA-jj69-4grx-fqj5, Gemini CLI Workspace Trust Bypass RCE
Severity
CRITICAL
CVSS
10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-07-11
Last reviewed
2026-07-11
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, software-development, devops
Target regions
Global
Detection rules
9
Indicators of compromise
23

Malware and tooling in Critical Gemini CLI Vulnerability (CVE-2026-12537) Enables

Malware and tooling: Gemini CLI, run-gemini-cli GitHub Action

CVE-2026-12537 (CVSS 10.0) in @google/gemini-cli (< 0.39.1, = 0.40.0-preview.2) and the google-github-actions/run-gemini-cli GitHub Action (< 0.1.22) allows an unauthenticated attacker to achieve pre-sandbox, host-level remote code execution on headless CI platforms by planting a malicious .gemini/.env file in a pull request, exploiting automatic workspace-trust and a --yolo tool-allowlist bypass. No active exploitation or public PoC has been reported.

How Critical Gemini CLI Vulnerability (CVE-2026-12537) Enables works

Google's Gemini CLI and its companion run-gemini-cli GitHub Action are widely used to run the Gemini agent inside CI/CD pipelines for tasks such as automated pull-request review, triage, and code generation. GHSA-wpqr-6v78-jr5g (CVE-2026-12537) documents two compounding design flaws that together allow an unprivileged external attacker to force their own malicious content to load as trusted Gemini configuration and execute arbitrary OS commands on the CI host before the agent's sandbox is even initialized.

First, in headless/non-interactive mode (the mode CI runners use), the CLI automatically trusted the workspace folder without any explicit user confirmation. This meant configuration and environment files under a repository's .gemini/ directory -- most critically .gemini/.env -- were parsed and loaded as legitimate local configuration with no verification that the repository content was trustworthy. An attacker who can get a pull request processed by the pipeline (e.g., an external contributor opening a PR against a public repo that runs Gemini-CLI-based PR review) can therefore smuggle a crafted .gemini/.env file containing attacker-controlled environment variables and command payloads into the CI job.

Second, the --yolo convenience flag -- intended to let trusted operators skip per-tool confirmation prompts -- was found to also silently bypass the fine-grained tool-execution allowlist defined in ~/.gemini/settings.json. Where a pipeline operator believed they had constrained the agent to a narrow set of safe tools, --yolo mode ignored that allowlist and permitted unrestricted shell command execution, compounding the impact of the workspace-trust bypass.

Chained together, these flaws let a malicious .gemini/.env entry execute attacker-controlled commands on the underlying CI host with the privileges of the pipeline job -- prior to any sandbox restriction taking effect -- yielding read access to repository secrets (e.g., GITHUB_TOKEN), build artifacts, and adjacent CI infrastructure, and potentially enabling credential theft, repository push access, and downstream supply-chain compromise of published packages or containers. The vulnerability was independently discovered and reported through Google's Vulnerability Rewards Program by Elad Meged of Novee Security and Dan Lisichkin of Pillar Security. Google published the GHSA advisory on 2026-04-24 (updated 2026-04-25) and shipped fixes (gemini-cli 0.39.1 / 0.40.0-preview.3; run-gemini-cli Action 0.1.22) removing implicit workspace trust in headless mode and enforcing the tool allowlist even under --yolo. As of disclosure, no evidence of in-the-wild exploitation or public proof-of-concept exists, and the CVE is not present in the CISA KEV catalog.

Coverage of this disclosure consistently grouped it with a wider wave of AI coding-agent CI/CD and IDE vulnerabilities reported in the same window, most notably two flaws in Anysphere's Cursor IDE: CVE-2026-26268 (CVSS 8.1), a git post-checkout hook execution issue reported by Novee Security researcher Assaf Levkovich and disclosed February 2026, in which an AI agent autonomously running `git checkout` inside an untrusted cloned repository silently triggers a malicious post-checkout hook and achieves code execution without explicit user awareness; and 'CursorJacking' (CVSS 8.2, unpatched at time of reporting), documented by LayerX researcher Roy Paz, in which Cursor fails to enforce access-control boundaries between installed extensions and local SQLite-based credential storage, letting any extension with filesystem access exfiltrate API keys and session tokens. These related disclosures illustrate a broader pattern of agentic coding tools inheriting host-level trust and execution privileges that traditional IDEs and CI runners did not extend to untrusted repository content, and are documented here as directly relevant context for the Gemini CLI finding rather than as the primary subject of this record.

MITRE ATT&CK techniques used in TL-2026-1206

Collection

T1005 Data from Local System

Execution

T1059 Command and Scripting Interpreter; T1059.004 Unix Shell; T1203 Exploitation for Client Execution

Discovery

T1082 System Information Discovery

Defense Evasion

T1140 Deobfuscate/Decode Files or Information; T1211 Exploitation for Stealth

Initial Access

T1195 Supply Chain Compromise; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship

Credential Access

T1528 Steal Application Access Token; T1552.001 Credentials In Files; T1555 Credentials from Password Stores

Persistence

T1546 Event Triggered Execution; T1546.001 Change Default File Association

privilege-escalation

T1548 Abuse Elevation Control Mechanism

Lateral Movement

T1550 Use Alternate Authentication Material

Exfiltration

T1567 Exfiltration Over Web Service

Privilege Escalation

T1611 Escape to Host

Affected products and versions in Critical Gemini CLI Vulnerability (CVE-2026-12537) Enables

  • Google — @google/gemini-cli
    Vulnerable versions: < 0.39.1; 0.40.0-preview.2
    Fixed in: 0.39.1; 0.40.0-preview.3
  • Google — google-github-actions/run-gemini-cli
    Vulnerable versions: < 0.1.22
    Fixed in: 0.1.22
  • Anysphere — Cursor IDE
    Vulnerable versions: versions prior to git post-checkout hook fix (CVE-2026-26268)
    Fixed in: patched release, February 2026 disclosure window

Remediation for Critical Gemini CLI Vulnerability (CVE-2026-12537) Enables

Patches

  • @google/gemini-cli 0.39.1
  • @google/gemini-cli 0.40.0-preview.3
  • google-github-actions/run-gemini-cli 0.1.22

Immediate actions

  • Upgrade @google/gemini-cli to 0.39.1 or 0.40.0-preview.3 or later
  • Upgrade google-github-actions/run-gemini-cli GitHub Action to 0.1.22 or later
  • Audit all CI/CD pipelines that invoke Gemini CLI against untrusted pull-request content for implicit workspace-trust assumptions
  • Inventory any other agentic coding CLIs/IDE extensions (e.g., Cursor) in the environment for equivalent workspace-trust or extension-isolation weaknesses

Workarounds

  • Only set GEMINI_TRUST_WORKSPACE=true for repositories/workflows that do not process untrusted external content
  • Configure and enforce a strict tool allowlist in ~/.gemini/settings.json and confirm it is honored even when --yolo is used
  • Pin the run-gemini-cli Action to a patched tag rather than a floating major-version reference

Longer-term hardening

  • Never run headless/non-interactive agentic CLI tooling against unreviewed external pull requests without an explicit trust gate
  • Enforce least-privilege scoped tokens (short-lived, narrowly-scoped GITHUB_TOKEN) for any workflow that processes untrusted content
  • Treat AI coding-agent CLIs and their CI integrations as part of the software supply chain attack surface and subject them to the same review as build tooling
  • Monitor for anomalous outbound network activity or secret access from CI runners immediately following PR-triggered agent invocations
  • Restrict AI IDE agents from autonomously executing git operations (clone/checkout) against untrusted or unreviewed repositories

CVEs associated with Critical Gemini CLI Vulnerability (CVE-2026-12537) Enables

CVE-2026-12537, CVE-2026-26268

Weaknesses (CWE) in Critical Gemini CLI Vulnerability (CVE-2026-12537) Enables

CWE-20, CWE-77, CWE-78, CWE-200, CWE-284, CWE-266

Timeline of Critical Gemini CLI Vulnerability (CVE-2026-12537) Enables

  • Novee Security researcher Assaf Levkovich discloses CVE-2026-26268 (CVSS 8.1), a Cursor IDE git post-checkout hook code-execution flaw triggered when an AI agent autonomously runs git operations against an untrusted cloned repository; reported alongside CVE-2026-12537 as part of the same wave of agentic-tooling CI/IDE trust-boundary findings.
  • Google publishes GHSA-wpqr-6v78-jr5g documenting CVE-2026-12537, a CVSS 10.0 workspace-trust and tool-allowlist bypass RCE affecting @google/gemini-cli and run-gemini-cli, with patched versions 0.39.1 / 0.40.0-preview.3 / 0.1.22 released alongside disclosure.
  • GitHub Security Advisory GHSA-wpqr-6v78-jr5g is updated one day after initial publication with refined technical detail.
  • The Hacker News and CSO Online report on the CVSS-10 Gemini CLI CI RCE alongside related Cursor IDE vulnerabilities (CVE-2026-26268 git-hook sandbox-escape RCE and the unpatched 'CursorJacking' extension access-control flaw documented by LayerX researcher Roy Paz), framing all three as part of a broader agentic-coding-tool trust-boundary problem.
  • Novee Security publishes independent technical analysis of the Gemini CLI RCE, crediting researcher Elad Meged and noting the flaw allowed malicious configuration to load and execute before sandbox initialization.
  • Novee Security's article is updated to incorporate additional findings from Dan Lisichkin of Pillar Security regarding the --yolo tool-allowlisting bypass.
  • Cyber Security News, GBHackers, and Cyberpress republish coverage of CVE-2026-12537, reiterating the CVSS 10.0 severity, affected version ranges, and remediation guidance for CI/CD operators.
  • As of this research pass, CVE-2026-12537 does not appear in the CISA Known Exploited Vulnerabilities catalog and no public exploitation or PoC has been documented; the flaw remains classified as theoretical/disclosed-and-patched.

Sources cited for Critical Gemini CLI Vulnerability (CVE-2026-12537) Enables

Threats related to Critical Gemini CLI Vulnerability (CVE-2026-12537) Enables

Detection coverage for TL-2026-1206

As of 2026-07-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1206 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats