48 matches found
run-gemini-cli
run-gemini-cli Overview run-gemini-cli is a GitHub Action that integrates Gemini into your development workflow via the Gemini CLI. It acts both as an autonomous agent for critical routine coding tasks, and an on-demand collaborator you can quickly delegate work to. Use it to perform GitHub pull...
CVE-2026-13745
A vulnerability in the Gemini CLI and associated GitHub Action allowed an unprivileged attacker to achieve an arbitrary code execution in Gemini CLI via untrusted local .env files overriding GEMINICLIHOME...
CVE-2026-13745 Arbitrary Code Execution in Gemini CLI via Symlinked Environment Variables
A vulnerability in the Gemini CLI and associated GitHub Action allowed an unprivileged attacker to achieve an arbitrary code execution in Gemini CLI via untrusted local .env files overriding GEMINICLIHOME...
EUVD-2026-75326
A vulnerability in the Gemini CLI and associated GitHub Action allowed an unprivileged attacker to achieve an arbitrary code execution in Gemini CLI via untrusted local .env files overriding GEMINICLIHOME...
CVE-2026-13745
CVE-2026-13745 is an arbitrary code execution vulnerability in Gemini CLI and its associated GitHub Action (google-github-actions/run-gemini-cli). An unprivileged attacker can exploit untrusted local .env files that override the GEMINI_CLI_HOME environment variable to gain code execution within t...
Malicious code in gemini-cli-a2a-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5eb13d8d28e4c8363ceabe294b988cd42a82f1875af3f2a30310232154664afd On npm install, the package's postinstall script collects host identifiers os.hostname, platform, arch, Node version, and package/lifecycle metadata...
CVE-2026-69207 vulnerabilities
Vulnerabilities for packages: librechat, wazuh-dashboard-fips, langfuse-fips, wazuh-dashboard, gemini-cli, kibana, langfuse...
GHSA-8J4G-W8FX-2239 vulnerabilities
Vulnerabilities for packages: librechat, wazuh-dashboard-fips, langfuse-fips, wazuh-dashboard, gemini-cli, kibana, langfuse...
GHSA-FRVP-7C67-39W9 vulnerabilities
Vulnerabilities for packages: kibana, librechat, gemini-cli...
PYSEC-2026-2475 FastMCP has a Command Injection vulnerability - Gemini CLI
Server names containing shell metacharacters e.g., & can cause command injection on Windows when passed to fastmcp install claude-code or fastmcp install gemini-cli. These install paths use subprocess.run with a list argument, but on Windows the target CLIs often resolve to .cmd wrappers that are...
GHSA-R275-FR43-PM7Q vulnerabilities
Vulnerabilities for packages: gemini-cli...
CVE-2026-28291 vulnerabilities
Vulnerabilities for packages: gemini-cli...
GHSA-JCXM-M3JX-F287 vulnerabilities
Vulnerabilities for packages: gemini-cli...
CVE-2026-28292 vulnerabilities
Vulnerabilities for packages: gemini-cli...
CVE-2026-12537
Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI versions prior to 0.39.1 and run-gemini-cli GitHub Action versions prior to 0.1.22 on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously...
CVE-2026-12537
Summary (CVE-2026-12537) : The vulnerability affects Google Gemini CLI container launcher (versions prior to 0.39.1) and the run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms. It stems from improper neutralization in an OS command, enabling an unprivileged attacker ...
EUVD-2026-38790
Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI versions prior to 0.39.1 and run-gemini-cli GitHub Action versions prior to 0.1.22 on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously...
CVE-2026-12537 Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows
Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI versions prior to 0.39.1 and run-gemini-cli GitHub Action versions prior to 0.1.22 on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously...
Malicious code in @ikyyofc/gemini-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5793a1cde3de83b8c15b49a0f9981d72fbf431067a4416ce6b2bd5650ea4a4d6 @ikyyofc/[email protected] ships two heavily obfuscated modules src/gemini.js and src/utils/proxy.js wrapped in an obfuscator.io-style string-array +...