{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-12537",
    "name": "CVE-2026-12537",
    "vendor": "Gemini CLI",
    "description": "Running headless in CI, Gemini CLI automatically trusted whatever workspace folder it was pointed at and loaded configuration from it, including a .gemini/.env file, before the container sandbox came up. A crafted .env reaches the container launcher as an OS command, so an unprivileged attacker who can influence repository contents, for instance through a pull request from a fork, executes code on the CI runner host itself. Found independently by Elad Meged of Novee Security and Dan Lisichkin of Pillar Security through Google's Vulnerability Rewards Program, and presented at Black Hat USA 2026 as one link in a chain that starts from an ordinary GitHub issue and ends at workflow secrets.",
    "website": "https://thehackernews.com/2026/08/claude-code-and-gemini-cli-flaws-let.html",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "ci",
    "updatedAt": "2026-08-07",
    "risk": {
      "score": 100,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-12537",
      "aliases": [
        "ti-071"
      ],
      "title": "CVE-2026-12537: Gemini CLI Command Injection Reaches CI Runner Hosts Before the Sandbox Starts (CVSS 10.0)",
      "summary": "Running headless in CI, Gemini CLI automatically trusted whatever workspace folder it was pointed at and loaded configuration from it, including a .gemini/.env file, before the container sandbox came up. A crafted .env reaches the container launcher as an OS command, so an unprivileged attacker who can influence repository contents, for instance through a pull request from a fork, executes code on the CI runner host itself. Found independently by Elad Meged of Novee Security and Dan Lisichkin of Pillar Security through Google's Vulnerability Rewards Program, and presented at Black Hat USA 2026 as one link in a chain that starts from an ordinary GitHub issue and ends at workflow secrets.",
      "severity": "critical",
      "cvss": {
        "score": 10,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Remote code execution"
      ],
      "componentType": "ci",
      "component": {
        "name": "Gemini CLI",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": "agent/gemini-cli"
      },
      "affected": [
        {
          "range": "Gemini CLI < 0.39.1; google-github-actions/run-gemini-cli < 0.1.22",
          "fixed": "0.39.1"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-08-07",
      "modifiedAt": "2026-08-07",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://thehackernews.com/2026/08/claude-code-and-gemini-cli-flaws-let.html"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12537"
        }
      ],
      "mitigation": "Upgrade Gemini CLI to 0.39.1 or later and run-gemini-cli to 0.1.22 or later. Until then do not run the agent against untrusted branches or forks on shared runners, and treat a .gemini/ directory as executable content in code review rather than as configuration.",
      "detectedByAnomity": false
    }
  }
}