2026-04-30 · 2026-Q2
Google Gemini CLI CVSS 10.0 Headless RCE
PrimaryL5ConfigSecondaryL7Build / Approval
- Fixable:
- Yes, vendor patch
- Vendor response:
- Patched
- In the wild:
- No
- Actor:
- Attacker
Target
Gemini CLI (`@google/gemini-cli`) before 0.39.1 and before 0.40.0-preview.3, and the `run-gemini-cli` GitHub Action before 0.1.22
Impact
Maximum-severity remote code execution in CI. Headless mode auto-trusted workspace folders, so a malicious config file in `.gemini/` executed before sandbox init and exposed any secrets, credentials, or source the workflow could reach, enabling token theft and lateral movement
Root Cause
Unsafe workspace-trust handling plus a tool-allowlist bypass under `--yolo` mode when processing untrusted pull requests or issues