# CVE-2026-12537: CVE-2026-12537: Gemini CLI Command Injection Reaches CI Runner Hosts Before the Sandbox Starts (CVSS 10.0)

> CVE-2026-12537 is a critical-severity remote code execution issue (CVSS 10.0) in Gemini CLI, a CI integration. Affected: Gemini CLI < 0.39.1; google-github-actions/run-gemini-cli < 0.1.22. Fixed in 0.39.1.

- **Canonical URL:** https://catalog.anomity.ai/vuln/cve-2026-12537
- **Aliases:** ti-071
- **Severity:** critical
- **CVSS:** 10
- **Attack type:** Remote code execution
- **Component:** Gemini CLI (CI integration)
- **Catalog entry:** https://catalog.anomity.ai/agent/gemini-cli
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-08-07
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/cve-2026-12537

## Summary

Running headless in CI, Gemini CLI automatically trusted whatever workspace folder it was pointed at and loaded configuration from it, including a .gemini/.env file, before the container sandbox came up. A crafted .env reaches the container launcher as an OS command, so an unprivileged attacker who can influence repository contents, for instance through a pull request from a fork, executes code on the CI runner host itself. Found independently by Elad Meged of Novee Security and Dan Lisichkin of Pillar Security through Google's Vulnerability Rewards Program, and presented at Black Hat USA 2026 as one link in a chain that starts from an ordinary GitHub issue and ends at workflow secrets.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| Gemini CLI < 0.39.1; google-github-actions/run-gemini-cli < 0.1.22 | 0.39.1 |

## Am I affected by CVE-2026-12537?

You are affected if you run Gemini CLI < 0.39.1; google-github-actions/run-gemini-cli < 0.1.22. Versions 0.39.1 and later include the fix.

## How do I fix CVE-2026-12537?

Upgrade Gemini CLI to 0.39.1 or later and run-gemini-cli to 0.1.22 or later. Until then do not run the agent against untrusted branches or forks on shared runners, and treat a .gemini/ directory as executable content in code review rather than as configuration.

## References

- article: https://thehackernews.com/2026/08/claude-code-and-gemini-cli-flaws-let.html
- cve: https://nvd.nist.gov/vuln/detail/CVE-2026-12537

## Related vulnerabilities

- [plugin4shell-sha-pinning-bypass-gives-zero-click-rce-across-claude-code](https://catalog.anomity.ai/vuln/plugin4shell-sha-pinning-bypass-gives-zero-click-rce-across-claude-code) — critical
- [comment-and-control-claude-code-gemini-cli-copilot-agents-vulnerable-to](https://catalog.anomity.ai/vuln/comment-and-control-claude-code-gemini-cli-copilot-agents-vulnerable-to) — critical
- [trustfall-one-click-rce-via-claude-code-trust-dialog-regression](https://catalog.anomity.ai/vuln/trustfall-one-click-rce-via-claude-code-trust-dialog-regression) — high
- [CVE-2026-114090](https://catalog.anomity.ai/vuln/cve-2026-114090) — high
- [CVE-2026-115726](https://catalog.anomity.ai/vuln/cve-2026-115726) — high
- [CVE-2026-114612](https://catalog.anomity.ai/vuln/cve-2026-114612) — critical

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=cve-2026-12537