p PatchFirst

PatchFirst · Latest vulnerabilities

@google/gemini-cli vulnerabilities

Vulnerabilities published for @google/gemini-cli in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. CVE-2026-12537

    Critical · CVSS 10EPSS 0.21%Fix available

    Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows

    Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously crafted .gemini/.env file.

    @google/gemini-cli @google/gemini-cliNode.js
    • Update to 0.39.1
    • Update to 0.40.0-preview.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →