Skip to content
AI Sec Watch
CriticalVulnerabilityLLM-specific

CVE-2026-12537: Google Gemini CLI OS command injection via crafted .gemini/.env file

Source
NVD(opens in a new tab)
Identifier
CVE-2026-12537
Published
Record updated
View JSON
Affected
  • @google/gemini-cli < 0.39.1, fixed in 0.39.1, released April 23, 2026, 61 days before disclosure
  • @google/gemini-cli = 0.40.0-preview.2, fixed in 0.40.0-preview.3, released April 23, 2026, 61 days before disclosure
  • google-github-actions/run-gemini-cli < 0.1.22, fixed in 0.1.22
Known exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS
0.2%

Summary

CVE-2026-12537 affects Google Gemini CLI (versions prior to 0.39.1) and the run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms. An unprivileged attacker can use a maliciously crafted .gemini/.env file to achieve pre-sandbox host-level code execution, via an OS command injection flaw in the container launcher. NVD has not yet provided an assessment; the CNA GoogleCloud rates it CVSS 4.0 10.0 CRITICAL.

Mitigation

Fixed in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22, the versions after which the flaw is no longer present. The source text does not describe further workarounds; the advisory is referenced at https://github.com/google-github-actions/run-gemini-cli/security/advisories/GHSA-wpqr-6v78-jr5g.

Related items