Critical, CVSS 10.0npmAmendedPublished
Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses
CVE-2026-12537 · GHSA-wpqr-6v78-jr5g
- Affected
- npm @google/gemini-cli < 0.39.1; >= 0.40.0-preview.2, <= 0.40.0-preview.2
- Fixed in
- 0.39.10.40.0-preview.3· Vendor fix available
- Issue
- Gemini CLI (@google/gemini-cli) and the run-gemini-cli GitHub Action are being updated to harden workspace trust and tool allowlisting, in particular when used in untrusted environments like GitHub Actions. This update introduces a breaking change to how non-interactive (headless) environments handle folder trust, which may impact existing CI/CD workflows under specific conditions. Details Folder Trust in Headless Mode In previous versions, Gemini CLI running in CI environments (headless mode) automatically trusted workspace folders for the purpose of loading configuration and environment variables. This is potentially risky in situations where Gemini CLI runs on untrusted folders in headless mode (e.g. CI workflows that review user-submitted pull requests). If used with untrusted directory contents, this could lead to remote code execution via malicious environment variables in the local .gemini/ directory. To ensure consistency and user control, the latest update aligns…
Recommended action: Upgrade to 0.40.0-preview.3 (pre-release) or 0.39.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.