CVE-2026-117560

The ATXP Gemini CLI extension (through version 1.0.0 ) contains an OS command injection vulnerability within the runAtxp() function. The root cause is the processing of unsanitized MCP tool parameters , which allows an attacker to execute shell commands as the user. Specifically, attackers can pl...