GHSA-4H5R-5JM8-JXJM gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)

Untrusted prompt input could reach the Gemini CLI @file parser, allowing read/exfiltration of arbitrary local files @/etc/passwd, @/.ssh/idrsa, @../../secret. On Windows, unquoted cmd.exe metacharacters could break out into OS command injection. Fix 1.1.6: removed the broken shell:false...

GHSA-V2V4-37R5-5V8G vulnerabilities

Vulnerabilities for packages: lerna, drupal, gemini-cli, npm, code-server, wazuh-dashboard, kubeflow-katib, pulumi, sqlpad, prism, wazuh-dashboard-fips, langfuse, langfuse-fips, librechat, saf, actions-runner, tileserver-gl, kibana, renovate, kubeflow-pipelines, graalvm, opensearch-dashboards-fip...

gemini-bug-bounty

Gemini Bug Bounty Find security vulnerabilities, get paid...

The Impact of AI-Assisted Development on Software Security: A Study of Gemini and Developer Experience

The ongoing shortage of skilled developers, particularly in security-critical software development, has led organizations to increasingly adopt AI-powered development tools to boost productivity and reduce reliance on limited human expertise. These tools, often based on large language models, aim...