CVE-2026-54785

Received Received - Intake

Arbitrary Local File Read in gemini-bridge

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: GitHub, Inc.

Description

gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip (and sent to Google), making this an arbitrary local file read. This issue is fixed in version 1.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-31

Last Modified

2026-07-31

Generated

2026-08-01

AI Q&A

2026-08-01

EPSS Evaluated

N/A

NVD

CVE-2026-54785

Affected Vendors & Products

Vendor	Product	Version / Range
gemini-bridge	gemini-bridge	to 1.3.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

The vulnerability in gemini-bridge versions 1.0.0 to 1.3.0 allows an attacker to read arbitrary local files. The consult_gemini_with_files function in inline mode does not restrict file paths provided in the files argument to the working directory. Attackers can supply any file path, which is then read and its contents sent to Google's Gemini AI via the CLI, effectively exposing local file contents.

Detection Guidance

This vulnerability allows arbitrary local file reads via the gemini-bridge MCP server. To detect it, check if gemini-bridge versions 1.0.0 to 1.3.1 are installed and inspect logs for suspicious file access patterns or unexpected file contents echoed through Gemini.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive files on your system. Attackers could read configuration files, credentials, or other confidential data stored locally. Since file contents are sent to Google's servers, there is also a risk of data exposure to third parties.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by exposing personal or sensitive data to unauthorized parties. Unauthorized file access may result in data breaches, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade gemini-bridge to version 1.3.1 or later immediately. If upgrading is not possible, disable the inline file reading feature or restrict file access to the working directory only.

Hi! I’m here to help you understand CVE-2026-54785. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70