Google has addressed a critical security vulnerability with a CVSS score of 10.0 in Gemini CLI , the company’s AI-powered code development tool. The vulnerability affects the npm package “@google/gemini-cli” and the GitHub Actions workflow “google-github-actions/run-gemini-cli” , allowing attackers to execute arbitrary commands on target systems.
See also: Google: Siri with Gemini technology coming in 2026
According to Novee Security, the vulnerability allowed unprivileged external attackers to inject malicious content as a configuration of the Gemini CLI. This would cause commands to be executed directly on the target system, bypassing security measures before the agent sandbox was even initialized. The vulnerability has not yet been assigned a CVE, but the maximum CVSS score of 10.0 underscores its severity.
The issue arose from the Gemini CLI that automatically trusted working folders when running in headless mode in CI/CD. In previous versions, the tool would automatically load configuration files and environment variables from the local .gemini/ without explicit user approval. This behavior proved dangerous when repositories accepted contributions from external sources.
Attackers could exploit this behavior by placing specially crafted configuration files in pull requests or repository content. Gemini CLI would automatically process and execute the malicious content, effectively turning CI/CD pipelines into supply-chain attack paths.
Technical details of the Gemini CLI vulnerability
The vulnerability combined multiple attack vectors. First, the automatic trust of working folders in headless mode allowed configuration loading without explicit approval. Second, the allowlisting tool did not properly enforce the restrictions set in ~/.gemini/settings.json. Third, the ability to process untrusted repository content in automated pipelines created additional risk.
See also: Google: Gemini AI stops malicious ads
Google noted that the impact is limited to workflows that use the Gemini CLI in headless mode. Any use of the tool in headless mode without folder trust will now require a manual review of the configuration of this trust mechanism. The update addresses the issue by requiring explicit folder trust before accessing configuration files.
At the same time, Novee Security also disclosed a high-severity vulnerability in the AI-powered Cursor before version 2.5 (CVE-2026-26268, CVSS score : 8.1). This vulnerability could also lead to arbitrary code execution via prompt injection, demonstrating that AI coding agents are increasingly attractive targets in software supply chains.
Protection and response instructions
Organizations using Gemini CLI should take immediate action. First, they should immediately upgrade the @google/gemini-cli and run-gemini-cli GitHub Actions to the patched versions. Workflows using older versions of Gemini CLI should be updated immediately.
Google suggests two approaches for users. If the workflow is running on trusted inputs (e.g. reviewing pull requests from trusted collaborators), GEMINI_TRUST_WORKSPACE: 'true' should be set in the workflow. If the workflow is running on untrusted inputs, users should follow Google 's guidance for hardening the workflow against malicious content.
See also: Google Gemini Ad Safety blocked 8.3 billion ads
Additionally, organizations should limit the token and secret permissions available in Gemini CLI in CI/CD environments . Avoiding editing untrusted content and carefully reviewing allowed tools and command execution settings are critical. In particular, the use of –yolo mode in untrusted environments should be avoided.
