CVE-2026-13745

Name of the Vulnerable Software and Affected Versions @google/gemini-cli versions prior to 0.39.1 run-gemini-cli GitHub Action (affected versions not specified)

Description An issue in the Gemini CLI and the associated GitHub Action allows an unprivileged attacker to achieve arbitrary code execution. This occurs when the tool is used in headless mode (such as CI environments) on untrusted folders, as it automatically trusted workspace folders for loading configuration and environment variables. An attacker can exploit this by placing malicious environment variables in a local .env file to override the GEMINI CLI HOME variable. Additionally, when running in --yolo mode, the tool previously ignored fine-grained tool allowlists in ~/.gemini/settings.json, which could lead to remote code execution via prompt injection if the run shell command() function was permitted.

Recommendations Update @google/gemini-cli to version 0.39.1 or 0.40.0-preview.3. For the run-gemini-cli GitHub Action, ensure the gemini cli version is updated to a patched version. If a workflow runs on trusted inputs, set the environment variable GEMINI TRUST WORKSPACE: 'true'. Review and harden workflows that process untrusted inputs to restrict folder trust and implement strict tool allowlisting.