Gemini CLI: Critical vulnerability allowed supply chain attacks

A critical vulnerability in Google ’s Gemini CLI could allow attackers to execute supply chain attacks via indirect prompt injections inserted into GitHub issues , cybersecurity firm Pillar Security warns . The discovery highlights the serious risks of integrating AI agents into critical development workflows without adequate security measures.

See also: DAEMON Tools Supply Chain Attack: Government organizations targeted

Gemini CLI is the open-source AI agent that provides access to Google ’s Gemini AI assistant directly from the terminal. The vulnerability, which received a CVSS score of 10/10 but was not assigned a CVE identifier , existed because Gemini CLI in –yolo mode ignored whitelists of allowed tools, leading to the execution of any command. This mode was designed to speed up development but created a serious security hole that could be exploited by malicious actors.

According to Pillar Security , an attacker could exploit the vulnerability by creating a public issue on a Google GitHub repository and hiding malicious prompts in the text. This technique, known as indirect prompt injection , allows attackers to manipulate AI systems without direct access to them. Because in –yolo mode all tool calls are automatically approved, the attacker could take control of the AI ​​agent designed to automatically triage GitHub issues submitted by users.

See also: Google attributes Axios Supply Chain Attack to UNC1069

Based on the imported instructions, the agent could extract internal secrets from the build environment and send them to a server controlled by the attacker. From these credentials, the attacker could pass a token with full write permissions to the repository . This would be a complete breach of the supply chain , as the attacker could push arbitrary code to the main branch of the gemini -cli repository , which would then be delivered to every user down the chain. This type of attack is reminiscent of the 2024 XZ Utils incident , where malicious code was injected into a critical library .

Protection recommendations and future challenges

Experts recommend immediately updating to @google/gemini-cli ≥0.39.1 or run-gemini-cli ≥0.1.22. Additionally, organizations should avoid –yolo mode and enable explicit workspace trust with the –trust. For CI/CD environments, it is recommended to run in isolated sandboxes, use whitelists of tools, and scan Pull Requests for .gemini/ and GEMINI.md.

See also: Axios Supply Chain Attack: Malicious versions distribute RAT

The discovery of this vulnerability highlights the emerging security risks associated with integrating AI agents into critical development workflows, according to the source. As the use of AI tools in software development continues to grow, organizations must implement strict security policies and closely monitor the use of these tools in production environments. The experience with Gemini CLI shows that rapid adoption of new technologies without adequate security assessment can create serious risks for entire supply chains.