GHSA-4H5R-5JM8-JXJM gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)

Untrusted prompt input could reach the Gemini CLI @file parser, allowing read/exfiltration of arbitrary local files @/etc/passwd, @/.ssh/idrsa, @../../secret. On Windows, unquoted cmd.exe metacharacters could break out into OS command injection. Fix 1.1.6: removed the broken shell:false...

GHSA-V2V4-37R5-5V8G vulnerabilities

Vulnerabilities for packages: langfuse-fips, tileserver-gl-fips, kibana, sqlpad, code-server, kubeflow-pipelines, renovate, prism, drupal, npm, librechat, wazuh-dashboard, wazuh-dashboard-fips, kubeflow-katib, opensearch-dashboards, gemini-cli, commercial-gitlab-rails-ee, saf, pulumi, graalvm,...

gemini-bug-bounty

Gemini Bug Bounty Find security vulnerabilities, get paid...

The Impact of AI-Assisted Development on Software Security: A Study of Gemini and Developer Experience

The ongoing shortage of skilled developers, particularly in security-critical software development, has led organizations to increasingly adopt AI-powered development tools to boost productivity and reduce reliance on limited human expertise. These tools, often based on large language models, aim...