Skip to content
AI Sec Watch
CriticalVulnerabilityLLM-specific

GHSA-wpqr-6v78-jr5g: Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses

Source
GitHub Advisory(opens in a new tab)
Identifier
GHSA-wpqr-6v78-jr5g
Published
Record updated
View JSON
Affected
  • google-github-actions/run-gemini-cli < 0.1.22, fixed in 0.1.22
  • @google/gemini-cli = 0.40.0-preview.2, fixed in 0.40.0-preview.3, released April 23, 2026, on the day of disclosure
  • @google/gemini-cli < 0.39.1, fixed in 0.39.1, released April 23, 2026, on the day of disclosure

Summary

Gemini CLI (`@google/gemini-cli`) and the `run-gemini-cli` GitHub Action are updated to harden workspace trust and tool allowlisting, especially in untrusted environments such as GitHub Actions. In headless mode, earlier versions automatically trusted workspace folders, so malicious environment variables in a local `.gemini/` directory could lead to remote code execution, and under `--yolo` the fine-grained tool allowlist in `~/.gemini/settings.json` was ignored. The update requires explicit folder trust and makes the policy engine evaluate tool allowlisting under `--yolo` (version `0.39.1`), which can break existing CI/CD workflows.

Mitigation

The folder trust and tool allowlisting mitigations are available in `@google/gemini-cli` version `0.39.1` and `0.40.0-preview.3`. Users must review their workflows and take one of two approaches: 1. If the workflow runs on trusted inputs, set `GEMINI_TRUST_WORKSPACE: 'true'` in the workflow. 2. If the workflow runs on untrusted inputs, review the guidance in google-github-actions/run-gemini-cli to harden the workflow against malicious content, and set the environment variable. If the workflow specifies a version via `gemini_cli_version`, upgrade to one of the patched versions and audit the workflow settings that use Gemini CLI.

Related items