41 matches found
Malicious code in gemini-cli-a2a-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5eb13d8d28e4c8363ceabe294b988cd42a82f1875af3f2a30310232154664afd On npm install, the package's postinstall script collects host identifiers os.hostname, platform, arch, Node version, and package/lifecycle metadata...
CVE-2026-69207 vulnerabilities
Vulnerabilities for packages: wazuh-dashboard-fips, wazuh-dashboard, librechat, langfuse-fips, langfuse, gemini-cli, kibana...
GHSA-8J4G-W8FX-2239 vulnerabilities
Vulnerabilities for packages: wazuh-dashboard-fips, wazuh-dashboard, librechat, langfuse-fips, langfuse, gemini-cli, kibana...
GHSA-FRVP-7C67-39W9 vulnerabilities
Vulnerabilities for packages: gemini-cli, kibana, librechat...
PYSEC-2026-2475 FastMCP has a Command Injection vulnerability - Gemini CLI
Server names containing shell metacharacters e.g., & can cause command injection on Windows when passed to fastmcp install claude-code or fastmcp install gemini-cli. These install paths use subprocess.run with a list argument, but on Windows the target CLIs often resolve to .cmd wrappers that are...
GHSA-R275-FR43-PM7Q vulnerabilities
Vulnerabilities for packages: gemini-cli...
CVE-2026-28291 vulnerabilities
Vulnerabilities for packages: gemini-cli...
CVE-2026-28292 vulnerabilities
Vulnerabilities for packages: gemini-cli...
GHSA-JCXM-M3JX-F287 vulnerabilities
Vulnerabilities for packages: gemini-cli...
CVE-2026-12537
Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI versions prior to 0.39.1 and run-gemini-cli GitHub Action versions prior to 0.1.22 on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously...
CVE-2026-12537
Summary (CVE-2026-12537) : The vulnerability affects Google Gemini CLI container launcher (versions prior to 0.39.1) and the run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms. It stems from improper neutralization in an OS command, enabling an unprivileged attacker ...
EUVD-2026-38790
Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI versions prior to 0.39.1 and run-gemini-cli GitHub Action versions prior to 0.1.22 on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously...
CVE-2026-12537 Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows
Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI versions prior to 0.39.1 and run-gemini-cli GitHub Action versions prior to 0.1.22 on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously...
Malicious code in @ikyyofc/gemini-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5793a1cde3de83b8c15b49a0f9981d72fbf431067a4416ce6b2bd5650ea4a4d6 @ikyyofc/[email protected] ships two heavily obfuscated modules src/gemini.js and src/utils/proxy.js wrapped in an obfuscator.io-style string-array +...
GHSA-Q7RR-3CGH-J5R3 vulnerabilities
Vulnerabilities for packages: langfuse-fips, langfuse, librechat, gemini-cli, kibana, cadence-web...
CVE-2026-44902 vulnerabilities
Vulnerabilities for packages: langfuse-fips, langfuse, librechat, gemini-cli, kibana, cadence-web...
CVE-2026-42338 vulnerabilities
Vulnerabilities for packages: kubeflow-katib, opensearch-dashboards, wazuh-dashboard, librechat, tileserver-gl-fips, wazuh-dashboard-fips, sqlpad, graalvm, langfuse, langfuse-fips, tileserver-gl, code-server, opensearch-dashboards-fips, npm, drupal, gemini-cli, kibana, kubeflow-pipelines, saf,...
Google Fixes CVSS 10 Gemini CLI Vulnerability Enabling GitHub Issue-Based RCE
Google patches a CVSS 10 Gemini CLI vulnerability that allowed hackers to use prompt injection and privilege escalation for a full supply chain compromise...
CVE-2026-41907 vulnerabilities
Vulnerabilities for packages: kubeflow-katib, opensearch-dashboards, wazuh-dashboard, tensorflow-cpu-jupyter, librechat, nemo, kubeflow-centraldashboard, dbgate, homepage, wazuh-dashboard-fips, nextcloud-server, sqlpad, langfuse, langfuse-fips, redisinsight, py3-captum, code-server,...