ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-12537

Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses

Published Apr 24, 2026 · catalog updated Sep 25, 2026 · Gemini CLI: Remote Code

Check if you run it

No confirmed exploitation is on record for CVE-2026-12537. EPSS is 0.21%. Act only if a listed version of Gemini CLI: Remote Code is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Gemini CLI: Remote Code).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Critical10.0
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.21%
Remediation
Advisory link
Affected products
GitHub Actions google-github-actions/run-gemini-cli · npm @google/gemini-cli

# Summary Gemini CLI ( ) and the GitHub Action are being updated to harden workspace trust and tool allowlisting, in particular when used in untrusted environments like GitHub Actions. This update introduces a breaking change to how non-interactive (headless) environments handle folder trust, which may impact existing CI/CD workflows under specific conditions. # Details Folder Trust in Headless Mode In previous versions, Gemini CLI running in CI environments (headless mode) automatically trusted workspace folders for the purpose of loading configuration and environment variables. This is potentially risky in situations where Gemini CLI runs on untrusted folders in headless mode (e.g. CI workflows that review user-submitted pull requests). If used with untrusted directory contents, this could lead to remote code execution via malicious environment variables in the local directory. To ensure consistency and user control, the latest update aligns headless mode behavior with interactive mode, requiring folders to be explicitly trusted before configuration files (such as ) are processed. As a result of this change, GitHub Actions and other automated pipelines that rely on the previous automatic trust behavior will fail to load workspace-specific settings until they are updated to use explicit trust mechanisms. Tool Allowlisting under \--yolo In previous versions, when Gemini CLI was configured to run in mode, it would ignore any fine grained tool allowlist in (e.g. would allow any command). This is potentially risky in situations where Gemini CLI runs on untrusted inputs with (e.g. CI workflows that triage user-submitted GitHub issues where we recommend a strict allowlist). If used with untrusted content and a tool allowlist that permits , this could lead to remote code execution via prompt injection. In version , the Gemini CLI policy engine now evaluates tool allowlisting under mode, which is useful for CI workflows that allowlist a few safe commands to run when proces

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • GitHub Actions google-github-actions/run-gemini-cli0 → 0.1.22
  • GitHub Actions google-github-actions/run-gemini-cli0 → 0.1.22; 0 → f77273f4c914 (github.com/google-github-actions/run-gemini-cli)
  • npm @google/gemini-cli0 → 0.39.1
  • npm @google/gemini-cli0.40.0-preview.2 → 0.40.0-preview.3

How to fix CVE-2026-12537

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-12537. EPSS is 0.21%. Act only if a listed version of Gemini CLI: Remote Code is installed.

Which versions are affected?

Compare what you have installed with 0 → 0.1.22, 0 → 0.1.22; 0 → f77273f4c914 (github.com/google-github-actions/run-gemini-cli), 0 → 0.39.1, 0.40.0-preview.2 → 0.40.0-preview.3. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-20: Improper Input Validation; CWE-200: Exposure of Sensitive Information; CWE-77: Command Injection. EPSS 0.21%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 24, 2026 · GitHub Advisory Database

    Detected

    # Summary Gemini CLI ( ) and the GitHub Action are being updated to harden workspace trust and tool allowlisting, in particular when used in untrusted environments like GitHub Actions. This update introduces a breaking change to how non-interactive (headless) environments handle folder trust, which may impact existing CI/CD workflows under specific conditions. # Details Folder Trust in Headless Mo

  2. Sep 25, 2026 · GitHub Advisory Database

    Fix available

    @google/gemini-cli fixed in 0.39.1; @google/gemini-cli fixed in 0.40.0-preview.3; google-github-actions/run-gemini-cli fixed in 0.1.22

  3. Sep 25, 2026 · GitHub Advisory Database

    Fix available

    @google/gemini-cli fixed in 0.39.1

  4. Sep 25, 2026 · GitHub Advisory Database

    Fix available

    @google/gemini-cli fixed in 0.40.0-preview.3

  5. Sep 25, 2026 · GitHub Advisory Database

    Fix available

    google-github-actions/run-gemini-cli fixed in 0.1.22

  6. Sep 25, 2026 · GitHub Advisory Database

    Fix available

    @google/gemini-cli fixed in 0.39.1; @google/gemini-cli fixed in 0.40.0-preview.3; google-github-actions/run-gemini-cli fixed in 0.1.22; google-github-actions/run-gemini-cli fixed in f77273f4c914

  7. Sep 25, 2026 · GitHub Advisory Database

    Fix available

    google-github-actions/run-gemini-cli fixed in 0.1.22; 0

  8. Sep 25, 2026 · GitHub Advisory Database

    Updated

    # Summary Gemini CLI ( ) and the GitHub Action are being updated to harden workspace trust and tool allowlisting, in particular when used in untrusted environments like GitHub Actions. This update introduces a breaking change to how non-interactive (headless) environments handle folder trust, which may impact existing CI/CD workflows under specific conditions. # Details Folder Trust in Headless Mo

Sources

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.