AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-c5px-58j2-7fqp: gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

mediumvulnerabilityLLM-Specific

security

Source: GitHub Advisory DatabaseJuly 31, 2026CVE-2026-54785

Summary

The gemini-bridge tool had a security flaw in its inline mode where the `consult_gemini_with_files` function could read any file on the system (like SSH keys or passwords) without checking if the file was in the allowed directory, then send that file contents to Google's Gemini service. An attacker using the tool, or an AI that has been tricked through prompt injection (hiding malicious instructions in text input), could exploit this to steal sensitive files that the server process can access.

Solution / Mitigation

Upgrade to version 1.3.1. The fix makes `_resolve_path` properly resolve symlinks (shortcuts to files) and use `Path.relative_to(root)` to ensure files stay within the working directory; inline mode now skips any file that resolves outside the allowed directory. As a temporary workaround before upgrading, avoid using `mode="inline"` with untrusted file inputs, or run the server under a user account with restricted permissions.