Gemini Bridge
Monthly
Arbitrary local file read in gemini-bridge (versions 1.0.0-1.3.0) exposes any file accessible to the server process - SSH keys, cloud credentials, `.env` files, source code - through the `consult_gemini_with_files` tool when operating in inline mode. Compounding the local disclosure, file contents are simultaneously exfiltrated to Google's infrastructure via the Gemini CLI round-trip, extending blast radius beyond the local host. No public exploit identified at time of analysis, but the CVSS vector (AV:L/AC:L/PR:N/UI:N) indicates trivially low exploitation complexity, and the GHSA advisory explicitly calls out prompt-injection as a realistic delivery vector for AI agent pipelines. Vendor-released patch available in version 1.3.1.
Arbitrary local file read in gemini-bridge (versions 1.0.0-1.3.0) exposes any file accessible to the server process - SSH keys, cloud credentials, `.env` files, source code - through the `consult_gemini_with_files` tool when operating in inline mode. Compounding the local disclosure, file contents are simultaneously exfiltrated to Google's infrastructure via the Gemini CLI round-trip, extending blast radius beyond the local host. No public exploit identified at time of analysis, but the CVSS vector (AV:L/AC:L/PR:N/UI:N) indicates trivially low exploitation complexity, and the GHSA advisory explicitly calls out prompt-injection as a realistic delivery vector for AI agent pipelines. Vendor-released patch available in version 1.3.1.