CVE-2026-12537

Name of the Vulnerable Software and Affected Versions Google Gemini CLI versions prior to 0.39.1 run-gemini-cli GitHub Action versions prior to 0.1.22

Description An OS command injection flaw exists in the container launcher used by Google Gemini CLI and the run-gemini-cli GitHub Action when operating on headless CI platforms. The issue stems from improper neutralization of input during the parsing and expansion of environment file contents, specifically within a maliciously crafted .gemini/.env file. This allows an unprivileged attacker to achieve pre-sandbox host-level remote code execution on the CI runner, which can lead to secret theft, lateral movement, and full pipeline compromise. This occurs before sandboxing is applied, meaning the attacker can execute commands directly on the host system.

Recommendations Update Google Gemini CLI to version 0.39.1 or later. Update run-gemini-cli GitHub Action to version 0.1.22 or later. For workflows running on trusted inputs, set the environment variable GEMINI TRUST WORKSPACE to true. For workflows running on untrusted inputs, review hardening guidance to restrict folder trust and avoid automatic processing of configuration files.