Which versions of Google Gemini CLI are affected by CVE-2026-12537?

Google Gemini CLI (versions <0.39.1) and run-gemini-cli GitHub Action (versions <0.1.22) enable unprivileged attackers to execute arbitrary commands on CI/CD runner hosts by planting malicious…. A patch is available.

Is there a public PoC exploit available for CVE-2026-12537?

Yes, a public proof-of-concept exploit is available for CVE-2026-12537. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-12537?

24 hours: Identify all pipelines using affected versions of Google Gemini CLI or run-gemini-cli; pause processing of external/untrusted code through these tools. 7 days: Upgrade Google Gemini CLI to 0.39.1 or later and run-gemini-cli GitHub Action to 0.1.22 or later; restore automated workflows only after upgrade verification. 30 days: Audit CI/CD runners for unauthorized access or credential theft; rotate secrets used in affected pipelines; assess risk from any PRs/contributions processed during vulnerable period.

Google Gemini CLI CVE-2026-12537

Q: What is the CVSS score of CVE-2026-12537?

CVE-2026-12537 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear. EPSS exploitation probability: 0.3%.

Q: Is there a public PoC exploit available for CVE-2026-12537?

Yes, a public proof-of-concept exploit is available for CVE-2026-12537. Prioritise patching immediately. EPSS: 0.3%.

Q: How to fix or mitigate CVE-2026-12537?

24 hours: Identify all pipelines using affected versions of Google Gemini CLI or run-gemini-cli; pause processing of external/untrusted code through these tools. 7 days: Upgrade Google Gemini CLI to 0.39.1 or later and run-gemini-cli GitHub Action to 0.1.22 or later; restore automated workflows only after upgrade verification. 30 days: Audit CI/CD runners for unauthorized access or credential theft; rotate secrets used in affected pipelines; assess risk from any PRs/contributions processed during vulnerable period.

EUVD-2026-38790 CRITICAL

Improper Input Validation (CWE-20)

2026-06-24 GoogleCloud

GHSA-jj69-4grx-fqj5

RCE Google Command Injection Gemini Cli Run Gemini Cli Github Action Google Cloud

10.0

CVSS 4.0 · Vendor: GoogleCloud

Severity by source

Vendor (GoogleCloud) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear

vuln.today AI

10.0 CRITICAL

Malicious .env arrives as repo content over the network (AV:N) and runs unauthenticated with no interaction in automated CI (PR:N/UI:N); pre-sandbox host execution escapes the intended sandbox (S:C) with full host impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GoogleCloud).

CVSS VectorVendor: GoogleCloud

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 24, 2026 - 15:02 EUVD

Source Code Evidence Fetched

Jun 24, 2026 - 14:20 vuln.today

Analysis Generated

Jun 24, 2026 - 14:20 vuln.today

CVE Published

Jun 24, 2026 - 13:37 cve.org

CRITICAL 10.0

DescriptionCVE.org

Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously crafted .gemini/.env file.

AnalysisAI

Pre-sandbox host-level code execution in Google Gemini CLI (versions prior to 0.39.1) and the run-gemini-cli GitHub Action (prior to 0.1.22) allows an unprivileged attacker to run arbitrary commands on CI/CD runner hosts by planting a malicious .gemini/.env file in an untrusted workspace. In headless mode the tool automatically trusted workspace folders and loaded their environment variables before sandboxing, so a workflow that processes attacker-controlled content (for example reviewing a submitted pull request) would execute attacker-supplied commands on the host. No public exploit has been identified at time of analysis, but Google rates this CVSS 4.0 10.0 and a vendor advisory (GHSA-wpqr-6v78-jr5g) with fixed releases is available.

Technical ContextAI

The affected technology is Google's Gemini CLI (npm @google/gemini-cli), an AI coding agent that runs shell commands and tools, and its wrapper the run-gemini-cli GitHub Action used to embed that agent in CI/CD pipelines. The root cause is classed as CWE-20 (Improper Input Validation), realized here as improper neutralization of OS commands in the container launcher: in non-interactive 'headless' execution the CLI auto-trusted the working directory and processed local configuration such as .gemini/.env before the sandbox boundary was established. Because environment variables and folder-trust settings were honored from untrusted, attacker-controllable directory contents, malicious values could influence the launcher and reach host-level command execution. The CPE data scopes this to cpe:2.3:a:google_cloud:gemini_cli and cpe:2.3:a:google_cloud:run-gemini-cli_github_action. A related hardening in the same release also makes the policy engine enforce fine-grained tool allowlists under --yolo mode, which previously could be bypassed (e.g. an allowlist of run_shell_command(echo) effectively permitting any command) and enable RCE via prompt injection.

RemediationAI

Vendor-released patch: upgrade @google/gemini-cli to 0.39.1 or later (preview users to 0.40.0-preview.3 or later) and upgrade the run-gemini-cli GitHub Action to 0.1.22 or later, per advisory GHSA-wpqr-6v78-jr5g (https://github.com/google-github-actions/run-gemini-cli/security/advisories/GHSA-wpqr-6v78-jr5g). The fix aligns headless behavior with interactive mode so folders must be explicitly trusted before configuration files such as .env are loaded; note the breaking change that existing CI workflows relying on automatic trust will fail to load workspace-specific settings until they adopt explicit trust mechanisms. Where immediate upgrade is not possible, do not run Gemini CLI in headless mode against untrusted directory contents such as forked or community pull requests, and isolate any such workflow on ephemeral runners with no secrets exposure; the trade-off is reduced automation coverage for external contributions. Additionally, when using --yolo mode on patched versions, define a strict fine-grained run_shell_command allowlist of only known-safe commands (now properly enforced by the policy engine), accepting that some previously-passing workflows may fail silently until their allowlists are corrected.