Improper OS Command Injection in Google Gemini CLI

Executive Summary

CVE-2026-12537 is a critical vulnerability in the Google Gemini CLI and the run-gemini-cli GitHub Action that affects headless CI platforms. It arises because the Gemini CLI, when running in headless mode, automatically trusted workspace folders, including configuration files in the .gemini/ directory. This improper trust allowed an unprivileged attacker to craft malicious environment files that could lead to pre-sandbox host-level code execution.

Additionally, the vulnerability involved a mode called --yolo which ignored tool allowlists, allowing any commands to run if run_shell_command was permitted, further enabling remote code execution through prompt injection.

The issue is caused by improper input validation and command injection weaknesses, specifically OS command injection, which can expose sensitive information and compromise system integrity.

Useful 0 Not Useful 0

Compliance Impact

CVE-2026-12537 allows an unprivileged attacker to achieve pre-sandbox host-level code execution, which can lead to exposure of sensitive information and compromise of confidentiality, integrity, and availability. Such impacts can negatively affect compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and secure system operations.

The vulnerability involves improper input validation and OS command injection, potentially exposing sensitive information (CWE-200). This exposure and the ability to execute arbitrary commands on the host system could lead to violations of data protection requirements mandated by these regulations.

Mitigations include updating to patched versions and following hardening guidance to ensure trusted inputs, which are necessary steps to maintain compliance and reduce risk.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts if you use Gemini CLI or the run-gemini-cli GitHub Action in headless CI/CD workflows. An attacker could execute arbitrary code on the host system before sandboxing occurs, leading to full host compromise.

• Complete loss of confidentiality, integrity, and availability of the affected system.
• Potential exposure of sensitive information due to command injection.
• Disruption or failure of CI/CD workflows if the vulnerability is exploited or if mitigations are improperly applied.

Users must either explicitly trust workspace folders or follow hardening guidance to mitigate risks, and update to patched versions to prevent exploitation.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects Gemini CLI running in headless mode (such as CI environments) that automatically trusts workspace folders and processes configuration files from the .gemini/ directory without explicit trust. Detection involves checking if your environment uses vulnerable versions of Gemini CLI (prior to 0.39.1) or run-gemini-cli GitHub Action (prior to 0.1.22) and whether untrusted .gemini/.env files are present.

You can detect the vulnerability by verifying the version of Gemini CLI or run-gemini-cli GitHub Action in use and inspecting the presence of .gemini/ directories with environment files in your CI workflows.

• Check Gemini CLI version: `gemini --version` or check the version of run-gemini-cli GitHub Action in your workflow files.
• Search for .gemini/.env files in your workspace or CI environment: `find . -path '*/.gemini/.env'`
• Review your CI/CD workflow configuration files for usage of Gemini CLI or run-gemini-cli GitHub Action and check if GEMINI_TRUST_WORKSPACE is set to true or not.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, upgrade to patched versions of Gemini CLI and run-gemini-cli GitHub Action. Specifically, update to Gemini CLI version 0.39.1 or later and run-gemini-cli GitHub Action version 0.1.22 or later.

Additionally, do not rely on automatic trust of workspace folders in headless CI environments. Instead, explicitly set the environment variable GEMINI_TRUST_WORKSPACE to true only for trusted inputs.

If you use the --yolo mode, ensure that tool allowlists are properly configured to prevent arbitrary command execution.

• Upgrade Gemini CLI to version 0.39.1 or later.
• Upgrade run-gemini-cli GitHub Action to version 0.1.22 or later.
• Set GEMINI_TRUST_WORKSPACE environment variable to true only for trusted inputs.
• Review and adjust tool allowlists if using --yolo mode.

Useful 0 Not Useful 0