Skip to content
AI Sec Watch
MediumVulnerabilityLLM-specific

GHSA-c5px-58j2-7fqp: gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

Source
GitHub Advisory(opens in a new tab)
Identifiers
CVE-2026-54785GHSA-c5px-58j2-7fqp
Published
Record updated
View JSON
Affected
  • gemini-bridge >= 1.0.0, < 1.3.1
Fixed in
1.3.1
  • released June 9, 2026, 52 days before disclosure
Known exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS
0.2%

Summary

gemini-bridge's consult_gemini_with_files tool, in inline mode, read any file path given in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, file contents are echoed back through the Gemini round-trip and sent to Google, letting an MCP client or a prompt-injected LLM read any file the server process can access.

Mitigation

Fixed in 1.3.1. _resolve_path now resolves symlinks and confines paths via Path.relative_to(root), and inline mode skips any entry that resolves outside the working directory. Before upgrading, avoid mode="inline" with untrusted files input, or run the server with a restricted-permission user.

Topics

Related items