GHSA-4H5R-5JM8-JXJM gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)

Untrusted prompt input could reach the Gemini CLI @file parser, allowing read/exfiltration of arbitrary local files @/etc/passwd, @/.ssh/idrsa, @../../secret. On Windows, unquoted cmd.exe metacharacters could break out into OS command injection. Fix 1.1.6: removed the broken shell:false...

GHSA-V2V4-37R5-5V8G vulnerabilities

Vulnerabilities for packages: kubeflow-katib, gemini-cli, librechat, graalvm, wazuh-dashboard, tileserver-gl-fips, renovate, prism, kubeflow-pipelines, saf, opensearch-dashboards, commercial-gitlab-rails-ee, lerna, sqlpad, langfuse, code-server, tileserver-gl, opensearch-dashboards-fips,...

gemini-bug-bounty

Gemini Bug Bounty Find security vulnerabilities, get paid...

The Impact of AI-Assisted Development on Software Security: A Study of Gemini and Developer Experience

The ongoing shortage of skilled developers, particularly in security-critical software development, has led organizations to increasingly adopt AI-powered development tools to boost productivity and reduce reliance on limited human expertise. These tools, often based on large language models, aim...