{"schema_version":"0.10.0","id":"LR-2026-0491","record_version":1,"title":"Google Gemini CLI flaw enabled host code execution and supply chain attacks","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":50.3,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":6.72,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: The Hacker News · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: The Hacker News · subject to change"}]},"sources_hash":"189a840154728ba11ea0cf944841653f599fc9cd98c82e839e98db7aa19cb4a7"},"system":{"model_name":null,"model_version":null,"developer":"Google","harness":"Gemini CLI","tools_granted":["run_shell_command"],"permissions_scope":null,"autonomy_level":"full-auto","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-04-30","incident_class":"security_compromise","failure_class":"injection_triggered","agent_involved":true,"secondary_failure_classes":[],"trigger":"prompt_injection","duration":null,"detection_method":"third_party","summary":"Google's Gemini CLI, an AI agent distributed as an npm package and a GitHub Actions workflow, had a flaw that could let an unprivileged external attacker run commands on the host. In headless mode the tool automatically trusted workspace folders when loading configuration, so planted configuration could execute code before the sandbox started. A separate bypass let prompt injection run shell commands in --yolo mode even where allowlists were set. Novee Security and Pillar Security reported the issues. Google's advisory said the impact is limited to workflows using Gemini CLI in headless mode. The update requires folders to be explicitly trusted and enforces tool allowlists under --yolo mode, and users were urged to review their workflows and set a trust variable depending on whether their inputs are trusted.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":"Indirect prompt injection in a GitHub issue led the agent to extract workflow secrets and send them to an attacker-controlled server.","responsible_party":"provider","adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK01","secondary_risks":["RK06"],"control_chain":[{"layer":"L2","party":"harness_vendor","party_name":null,"control_id":"E1","outcome":"got_around","reason":null,"quote":"This triggered command execution directly on the host system, bypassing security before the agent’s sandbox even initialized.","source_index":0,"reviewed":false},{"layer":"L2","party":"harness_vendor","party_name":null,"control_id":"A6","outcome":"got_around","reason":null,"quote":"The tech giant also noted that it's taking steps to harden tool allowlisting when Gemini CLI is configured to run in --yolo mode to prevent scenarios where untrusted inputs (e.g., user-submitted GitHub issues) could lead to remote code execution via prompt injection by taking advantage of the fact that the auto-approve mode would ignore any allowlist in \"~/.gemini/settings.json\" and run all tool calls automatically (including \"run_shell_command\") without requiring user confirmation.","source_index":0,"reviewed":false},{"layer":"L3","party":"deployer","party_name":null,"control_id":"B1","outcome":"missing","reason":null,"quote":"This automatic trust of the current workspace folder meant that the tool could load any agent configuration it found without review, sandboxing, or explicit user consent.","source_index":0,"reviewed":false}],"remediations":[{"by":null,"kind":"fix","date_reported":null,"controls_added":["A6"],"quote":"\"In version 0.39.1, the Gemini CLI policy engine now evaluates tool allowlisting under --yolo mode, which is useful for CI workflows that allowlist a few safe commands to run when processing untrusted inputs,\" Google said.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"moderate: bounded scope stated; Google said the impact is limited to workflows using Gemini CLI in headless mode","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2026/04/google-fixes-cvss-10-gemini-cli-ci-rce.html","publisher":"The Hacker News","date":"2026-04-30","type":"press","title":"Google Fixes CVSS 10 Gemini CLI CI RCE and Cursor Flaws Enable Code Execution - The Hacker News","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.developer":"C","system.harness":"C","system.tools_granted":"C","system.autonomy_level":"C","event.incident_class":"C","event.agent_involved":"C","event.failure_class":"C","event.failure_class_detail":"C","event.trigger":"C","event.detection_method":"C","event.responsible_party":"C","event.adversarial_actor":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.control_chain":"C","event.remediations":"C","event.summary":"C","system.deployment_context":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"Google has addressed a maximum severity security flaw in Gemini CLI -- the \"@google/gemini-cli\" npm package and the \"google-github-actions/run-gemini-cli\" GitHub Actions workflow -- that could have allowed attackers to execute arbitrary commands on host systems."}],"system.harness":[{"source_index":0,"quote":"Google has addressed a maximum severity security flaw in Gemini CLI -- the \"@google/gemini-cli\" npm package and the \"google-github-actions/run-gemini-cli\" GitHub Actions workflow -- that could have allowed attackers to execute arbitrary commands on host systems."}],"system.tools_granted":[{"source_index":0,"quote":"The tech giant also noted that it's taking steps to harden tool allowlisting when Gemini CLI is configured to run in --yolo mode to prevent scenarios where untrusted inputs (e.g., user-submitted GitHub issues) could lead to remote code execution via prompt injection by taking advantage of the fact that the auto-approve mode would ignore any allowlist in \"~/.gemini/settings.json\" and run all tool calls automatically (including \"run_shell_command\") without requiring user confirmation."}],"system.autonomy_level":[{"source_index":0,"quote":"The tech giant also noted that it's taking steps to harden tool allowlisting when Gemini CLI is configured to run in --yolo mode to prevent scenarios where untrusted inputs (e.g., user-submitted GitHub issues) could lead to remote code execution via prompt injection by taking advantage of the fact that the auto-approve mode would ignore any allowlist in \"~/.gemini/settings.json\" and run all tool calls automatically (including \"run_shell_command\") without requiring user confirmation."}],"event.incident_class":[{"source_index":0,"quote":"An attacker could weaponize this behavior by planting a specially crafted configuration that could pave the way for code execution on the host running the agent, effectively turning CI/CD pipelines into supply-chain attack paths."}],"event.agent_involved":[{"source_index":0,"quote":"An attacker could weaponize this behavior by planting a specially crafted configuration that could pave the way for code execution on the host running the agent, effectively turning CI/CD pipelines into supply-chain attack paths."}],"event.failure_class":[{"source_index":0,"quote":"Put differently, the vulnerability enables a full supply chain compromise that starts from a GitHub issue, which causes the AI agent to parse hidden instructions via indirect prompt injection, extract workflow internal secrets (e.g., GITHUB_TOKEN) from the build environment, and exfiltrate them to an attacker-controlled server."}],"event.failure_class_detail":[{"source_index":0,"quote":"Put differently, the vulnerability enables a full supply chain compromise that starts from a GitHub issue, which causes the AI agent to parse hidden instructions via indirect prompt injection, extract workflow internal secrets (e.g., GITHUB_TOKEN) from the build environment, and exfiltrate them to an attacker-controlled server."}],"event.trigger":[{"source_index":0,"quote":"Put differently, the vulnerability enables a full supply chain compromise that starts from a GitHub issue, which causes the AI agent to parse hidden instructions via indirect prompt injection, extract workflow internal secrets (e.g., GITHUB_TOKEN) from the build environment, and exfiltrate them to an attacker-controlled server."}],"event.detection_method":[{"source_index":0,"quote":"Pillar Security researcher Dan Lisichkin, who is credited with discovering and reporting the allowlisting bypass, said the vulnerability represents an instance of the \"lethal trifecta,\" where a combination of access to private data, exposure to untrusted content, and the ability to externally communicate creates new pathways for data theft."}],"event.responsible_party":[{"source_index":0,"quote":"Google has addressed a maximum severity security flaw in Gemini CLI -- the \"@google/gemini-cli\" npm package and the \"google-github-actions/run-gemini-cli\" GitHub Actions workflow -- that could have allowed attackers to execute arbitrary commands on host systems."}],"event.adversarial_actor":[{"source_index":0,"quote":"\"The vulnerability allowed an unprivileged external attacker to force their own malicious content to load as Gemini configuration,\" Novee Security said in a Wednesday report."}],"impact.severity":[{"source_index":0,"quote":"In its advisory published last week, Google said the impact is limited to workflows using Gemini CLI in headless mode, adding that any use of the tool in headless mode without folder trust will require manual review to configure this trust mechanism."}],"impact.severity_because":[{"source_index":0,"quote":"In its advisory published last week, Google said the impact is limited to workflows using Gemini CLI in headless mode, adding that any use of the tool in headless mode without folder trust will require manual review to configure this trust mechanism."}],"event.control_chain":[{"source_index":0,"quote":"This triggered command execution directly on the host system, bypassing security before the agent’s sandbox even initialized."},{"source_index":0,"quote":"The tech giant also noted that it's taking steps to harden tool allowlisting when Gemini CLI is configured to run in --yolo mode to prevent scenarios where untrusted inputs (e.g., user-submitted GitHub issues) could lead to remote code execution via prompt injection by taking advantage of the fact that the auto-approve mode would ignore any allowlist in \"~/.gemini/settings.json\" and run all tool calls automatically (including \"run_shell_command\") without requiring user confirmation."},{"source_index":0,"quote":"This automatic trust of the current workspace folder meant that the tool could load any agent configuration it found without review, sandboxing, or explicit user consent."}],"event.remediations":[{"source_index":0,"quote":"\"In version 0.39.1, the Gemini CLI policy engine now evaluates tool allowlisting under --yolo mode, which is useful for CI workflows that allowlist a few safe commands to run when processing untrusted inputs,\" Google said."}],"event.summary":[{"source_index":0,"quote":"Google has addressed a maximum severity security flaw in Gemini CLI -- the \"@google/gemini-cli\" npm package and the \"google-github-actions/run-gemini-cli\" GitHub Actions workflow -- that could have allowed attackers to execute arbitrary commands on host systems."},{"source_index":0,"quote":"This automatic trust of the current workspace folder meant that the tool could load any agent configuration it found without review, sandboxing, or explicit user consent."},{"source_index":0,"quote":"\"The vulnerability allowed an unprivileged external attacker to force their own malicious content to load as Gemini configuration,\" Novee Security said in a Wednesday report."},{"source_index":0,"quote":"The tech giant also noted that it's taking steps to harden tool allowlisting when Gemini CLI is configured to run in --yolo mode to prevent scenarios where untrusted inputs (e.g., user-submitted GitHub issues) could lead to remote code execution via prompt injection by taking advantage of the fact that the auto-approve mode would ignore any allowlist in \"~/.gemini/settings.json\" and run all tool calls automatically (including \"run_shell_command\") without requiring user confirmation."},{"source_index":0,"quote":"Pillar Security researcher Dan Lisichkin, who is credited with discovering and reporting the allowlisting bypass, said the vulnerability represents an instance of the \"lethal trifecta,\" where a combination of access to private data, exposure to untrusted content, and the ability to externally communicate creates new pathways for data theft."},{"source_index":0,"quote":"In its advisory published last week, Google said the impact is limited to workflows using Gemini CLI in headless mode, adding that any use of the tool in headless mode without folder trust will require manual review to configure this trust mechanism."},{"source_index":0,"quote":"The update addresses the problem by requiring folders to be explicitly trusted before configuration files can be accessed."}]},"notes_on_gaps":"Only one source was provided. No date of occurrence, date of disclosure or date of detection is stated in the body text; the article date 2026-04-30 was not used as a disclosure date. The Gemini CLI flaw has no CVE identifier and no count of affected users or parties is stated. No model name or version is given. No direct loss, records exposed or remediation hours are stated. Judgements made: autonomy_level set to full-auto based on the --yolo auto-approve description; detection_method set to third_party because Pillar Security is credited with the allowlisting bypass report; root_cause set to guardrail because the automatic folder trust and allowlist behaviour are the failed safeguards; severity set to moderate on the bounded-scope test quoted from Google's advisory. Control B2 was assigned to the folder-trust fix and A6 to the policy engine change as judgements. The Cursor vulnerabilities in the same article concern a different product and were excluded from this record. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: The Hacker News · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Gemini CLI running headless in CI automatically trusted workspace folders when loading configuration.","quote":"\"In previous versions, Gemini CLI running in CI environments (headless mode) automatically trusted workspace folders for the purpose of loading configuration and environment variables,\" it said.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"Planted configuration could run code on the host running the agent, turning CI/CD pipelines into supply-chain attack paths.","quote":"An attacker could weaponize this behavior by planting a specially crafted configuration that could pave the way for code execution on the host running the agent, effectively turning CI/CD pipelines into supply-chain attack paths.","source_index":0,"grade":"C"},{"step":"reached","text":"Hidden instructions in a GitHub issue could make the agent extract workflow secrets and send them to an attacker-controlled server.","quote":"Put differently, the vulnerability enables a full supply chain compromise that starts from a GitHub issue, which causes the AI agent to parse hidden instructions via indirect prompt injection, extract workflow internal secrets (e.g., GITHUB_TOKEN) from the build environment, and exfiltrate them to an attacker-controlled server.","source_index":0,"grade":"C"},{"step":"caught","text":"Pillar Security researcher Dan Lisichkin was credited with discovering and reporting the allowlisting bypass.","quote":"Pillar Security researcher Dan Lisichkin, who is credited with discovering and reporting the allowlisting bypass, said the vulnerability represents an instance of the \"lethal trifecta,\" where a combination of access to private data, exposure to untrusted content, and the ability to externally communicate creates new pathways for data theft.","source_index":0,"grade":"C"},{"step":"done","text":"The update requires folders to be explicitly trusted before configuration files can be accessed.","quote":"The update addresses the problem by requiring folders to be explicitly trusted before configuration files can be accessed.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/04/google-fixes-cvss-10-gemini-cli-ci-rce.html"]},"analysis":{"sections":{"timeline":[{"text":"Google published an advisory stating the impact is limited to workflows using Gemini CLI in headless mode.","quote":"In its advisory published last week, Google said the impact is limited to workflows using Gemini CLI in headless mode, adding that any use of the tool in headless mode without folder trust will require manual review to configure this trust mechanism.","source_index":0,"when":null},{"text":"Novee Security reported the flaw in a Wednesday report.","quote":"\"The vulnerability allowed an unprivileged external attacker to force their own malicious content to load as Gemini configuration,\" Novee Security said in a Wednesday report.","source_index":0,"when":null},{"text":"Gemini CLI version 0.39.1 began evaluating tool allowlisting under --yolo mode.","quote":"In version 0.39.1, the Gemini CLI policy engine now evaluates tool allowlisting under --yolo mode, which is useful for CI workflows that allowlist a few safe commands to run when processing untrusted inputs,\" Google said.","source_index":0,"when":null},{"text":"The update required folders to be explicitly trusted before configuration files could be accessed.","quote":"The update addresses the problem by requiring folders to be explicitly trusted before configuration files can be accessed.","source_index":0,"when":null},{"text":"The article was updated with additional insights from Pillar Security.","quote":"(The story was updated after publication on May 7, 2026, to include additional insights from Pillar Security.)","source_index":0,"when":"2026-05-07"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/04/google-fixes-cvss-10-gemini-cli-ci-rce.html"]}}