CVE-2026-12537: Gemini CLI Command Injection Reaches CI Runner Hosts Before the Sandbox Starts (CVSS 10.0)
CVE-2026-12537 is a critical-severity remote code execution issue (CVSS 10.0) in Gemini CLI, a CI integration. Affected: Gemini CLI < 0.39.1; google-github-actions/run-gemini-cli < 0.1.22. Fixed in 0.39.1.
Is Gemini CLI running on your developers' machines? Anomity inventories the AI agents, MCP servers, extensions and skills on every developer device, so you can see what this advisory touches. Detect this across your developers' devices with Anomity →
Key facts
- ID
CVE-2026-12537- Severity
- critical
- CVSS score
- 10.0
- Attack type
- Remote code execution
- Component
- Gemini CLI · CI integration
- Known exploited
- No known exploitation
- Published
- Last verified
What is CVE-2026-12537?
Running headless in CI, Gemini CLI automatically trusted whatever workspace folder it was pointed at and loaded configuration from it, including a .gemini/.env file, before the container sandbox came up. A crafted .env reaches the container launcher as an OS command, so an unprivileged attacker who can influence repository contents, for instance through a pull request from a fork, executes code on the CI runner host itself. Found independently by Elad Meged of Novee Security and Dan Lisichkin of Pillar Security through Google's Vulnerability Rewards Program, and presented at Black Hat USA 2026 as one link in a chain that starts from an ordinary GitHub issue and ends at workflow secrets.
Affected versions
| Affected | Fixed in |
|---|---|
Gemini CLI < 0.39.1; google-github-actions/run-gemini-cli < 0.1.22 | 0.39.1 |
Am I affected by CVE-2026-12537?
You are affected if you run Gemini CLI < 0.39.1; google-github-actions/run-gemini-cli < 0.1.22. Versions 0.39.1 and later include the fix.
How do I fix CVE-2026-12537?
Upgrade Gemini CLI to 0.39.1 or later and run-gemini-cli to 0.1.22 or later. Until then do not run the agent against untrusted branches or forks on shared runners, and treat a .gemini/ directory as executable content in code review rather than as configuration.