Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

gemini-bridge

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.2PyPIPublished

    gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

    CVE-2026-54785 · GHSA-c5px-58j2-7fqp

    Affected
    • PyPI gemini-bridge >= 1.0.0, < 1.3.1
    Fixed in
    1.3.1· Vendor fix available
    Issue
    consultgeminiwithfiles in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip (and sent to Google), making this an arbitrary local file read. Impact An MCP client — or an LLM that has been prompt-injected into calling the tool — can read any file the server process can access (SSH keys, cloud credentials, .env, source) and have it disclosed via the tool response. No code execution by itself. Affected component - Tool: consultgeminiwithfiles(query, directory, files, …), mode="inline" - Sink: readfileforinline via prepareinlinepayload in src/mcpserver.py - The atcommand mode already confined paths; inline mode did not. Root cause resolvepath returned an out-of-root path while only nullifying the display name, and prepareinlinepayload read the file regardless. Absolute…

    Recommended action: Upgrade to 1.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →