CVE-2026-13745: A vulnerability in the Gemini CLI and associated GitHub Action allowed an unprivileged attacker to achieve an arbitrary

A vulnerability in Gemini CLI (a command-line tool) and its GitHub Action integration allowed an attacker without special permissions to run arbitrary code (execute any commands they want) by creating a malicious .env file (a configuration file that sets environment variables) that overrides the GEMINI_CLI_HOME setting.