What is the CVSS score of CVE-2026-54785?

CVE-2026-54785 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-54785?

Yes, a public proof-of-concept exploit is available for CVE-2026-54785. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-54785?

Yes, a patch is available for CVE-2026-54785. Update the affected software to the latest version immediately.

gemini-bridge CVE-2026-54785

MEDIUM

Path Traversal (CWE-22)

2026-07-31 GitHub_M

GHSA-c5px-58j2-7fqp

Path Traversal Google Gemini Bridge

6.2

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.2 MEDIUM

AV:L reflects local MCP transport access; PR:N since no intra-application auth guards tool invocation; C:H for arbitrary file read of any process-accessible file.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 31, 2026 - 23:21 vuln.today

Analysis Generated

Jul 31, 2026 - 23:21 vuln.today

DescriptionCVE.org

gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip (and sent to Google), making this an arbitrary local file read. This issue is fixed in version 1.3.1.

AnalysisAI

Arbitrary local file read in gemini-bridge (versions 1.0.0-1.3.0) exposes any file accessible to the server process - SSH keys, cloud credentials, .env files, source code - through the consult_gemini_with_files tool when operating in inline mode. Compounding the local disclosure, file contents are simultaneously exfiltrated to Google's infrastructure via the Gemini CLI round-trip, extending blast radius beyond the local host. No public exploit identified at time of analysis, but the CVSS vector (AV:L/AC:L/PR:N/UI:N) indicates trivially low exploitation complexity, and the GHSA advisory explicitly calls out prompt-injection as a realistic delivery vector for AI agent pipelines. Vendor-released patch available in version 1.3.1.

Technical ContextAI

gemini-bridge is a Python pip package (cpe:2.3:a:elyin:gemini-bridge:*:*:*:*:*:*:*:*) implementing the Model Context Protocol (MCP) to bridge AI agent workflows to Google's Gemini CLI. The vulnerable surface is the consult_gemini_with_files(query, directory, files, …) function in src/mcp_server.py, specifically when called with mode="inline". In that mode, caller-supplied entries in the files argument passed through _prepare_inline_payload → _read_file_for_inline without a directory-confinement check. The root cause (CWE-22: Path Traversal) is that _resolve_path computed an out-of-bounds absolute path but only nullified the *display name*, not the actual read operation - meaning absolute paths, ../ traversal sequences, and symlinks pointing outside the working directory were all silently dereferenced. The at_command mode already enforced Path.relative_to(root) confinement; inline mode lacked the equivalent guard entirely. The fix in 1.3.1 applies Path.resolve() to both the root and candidate before calling relative_to, and skips any entry resolving outside the root with a warning rather than reading it.

RemediationAI

Upgrade to gemini-bridge version 1.3.1, released 2026-06-09, which resolves the path traversal by enforcing symlink-resolved directory confinement in _resolve_path via Path.relative_to(root), matching the existing at_command mode behavior. The patched release is confirmed at https://github.com/eLyiN/gemini-bridge/releases/tag/v1.3.1 and the fix commit is 8f3b85afd02b692c4bc974b5176e12fb277ea801. Prior to upgrading, the vendor advisory recommends avoiding mode="inline" entirely with any untrusted files input - switching to at_command mode is a viable workaround since that mode already enforced path confinement. As an additional compensating control, run the gemini-bridge server process under a restricted OS user account with minimal filesystem access, particularly excluding SSH key directories, credential stores, and .env files; this limits what files can be read even if the path traversal is triggered. In AI agent pipelines, restrict which MCP clients or LLMs are authorized to invoke consult_gemini_with_files, and treat any document or external content processed by the driving LLM as potentially untrusted to mitigate prompt-injection delivery.