Name of the Vulnerable Software and Affected Versions @google/gemini-cli versions prior to 0.39.1 run-gemini-cli (affected versions not specified)

Description Issues exist in the handling of workspace trust and tool allowlisting when running in headless mode, such as within CI/CD environments. In affected versions, the software automatically trusted workspace folders, which could allow remote code execution via malicious environment variables located in the .gemini/ directory if the tool processes untrusted directory contents. Additionally, when using the --yolo mode, the system ignored fine-grained tool allowlists in ~/.gemini/settings.json. This could lead to remote code execution via prompt injection if the run shell command() function is permitted while processing untrusted inputs.

Recommendations Update @google/gemini-cli to version 0.39.1 or 0.40.0-preview.3. For run-gemini-cli, ensure the gemini cli version is updated to 0.39.1 or 0.40.0-preview.3. If the workflow runs on trusted inputs, set the environment variable GEMINI TRUST WORKSPACE to 'true'. If the workflow runs on untrusted inputs, restrict the use of the run shell command() function by configuring a strict tool allowlist in ~/.gemini/settings.json.