run-gemini-cli

run-gemini-cli Overview run-gemini-cli is a GitHub Action that integrates Gemini into your development workflow via the Gemini CLI. It acts both as an autonomous agent for critical routine coding tasks, and an on-demand collaborator you can quickly delegate work to. Use it to perform GitHub pull...

CVE-2026-117560

ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp that allows attackers to execute shell commands through unsanitized MCP tool parameters. Attackers can plant instructions in email or SMS content to inject $ or backtick substitutions into parameters...

CVE-2026-117560 ATXP Gemini CLI Extension through 1.0.0 OS Command Injection via MCP Tools

ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp that allows attackers to execute shell commands through unsanitized MCP tool parameters. Attackers can plant instructions in email or SMS content to inject $ or backtick substitutions into parameters...

EUVD-2026-110838

ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp that allows attackers to execute shell commands through unsanitized MCP tool parameters. Attackers can plant instructions in email or SMS content to inject $ or backtick substitutions into parameters...

CVE-2026-117560

The ATXP Gemini CLI extension (through version 1.0.0 ) contains an OS command injection vulnerability within the runAtxp() function. The root cause is the processing of unsanitized MCP tool parameters , which allows an attacker to execute shell commands as the user. Specifically, attackers can pl...

PT-2026-126419

ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp that allows attackers to execute shell commands through unsanitized MCP tool parameters. Attackers can plant instructions in email or SMS content to inject $ or backtick substitutions into parameters...

GHSA-27R3-JXMH-P828 vulnerabilities

Vulnerabilities for packages: langfuse, wazuh-dashboard-fips, wazuh-dashboard, azurite, pelias-api, kubeflow-centraldashboard, kibana, arangodb, json-server, unleash-fips, thingsboard, unleash, kubescape-grype-offline-db, verdaccio, node-red, gemini-cli, tileserver-gl, tileserver-gl-fips,...

CVE-2026-111181 vulnerabilities

Vulnerabilities for packages: langfuse, wazuh-dashboard-fips, wazuh-dashboard, azurite, pelias-api, kubeflow-centraldashboard, kibana, arangodb, json-server, unleash-fips, thingsboard, unleash, kubescape-grype-offline-db, verdaccio, node-red, gemini-cli, tileserver-gl, tileserver-gl-fips,...

Compaction Laundering: Provenance Destruction in Context-Compacting Coding Agents

Coding agents that run long enough must compact their context, summarizing the conversation, discarding the original, and carrying the summary forward as memory. We show that in popular open-source coding agents this step is an exploitable trust boundary. Harnesses that flatten the typed...

CVE-2026-102422 vulnerabilities

Vulnerabilities for packages: arangodb, commercial-gitlab-rails-ee, gemini-cli, eco-jess, gitlab-rails-ce-fips, renovate, gitlab-rails-ce, commercial-gitlab-rails-ee-fips, code-server...

GHSA-PQG4-J6R4-53MV vulnerabilities

Vulnerabilities for packages: arangodb, commercial-gitlab-rails-ee, gemini-cli, eco-jess, gitlab-rails-ce-fips, renovate, gitlab-rails-ce, commercial-gitlab-rails-ee-fips, code-server...

GHSA-JJ69-4GRX-FQJ5 vulnerabilities

Vulnerabilities for packages: gemini-cli...

CVE-2026-56762 vulnerabilities

Vulnerabilities for packages: langfuse, gemini-cli, opensearch-dashboards, librechat, langfuse-fips, opensearch-dashboards-fips, kibana...

GHSA-55CM-P4WW-685G vulnerabilities

Vulnerabilities for packages: langfuse, gemini-cli, opensearch-dashboards, librechat, langfuse-fips, opensearch-dashboards-fips, kibana...

CVE-2026-12537 vulnerabilities

Vulnerabilities for packages: gemini-cli...

Security Bulletin: Multiple Vulnerabilities in IBM Bob

Summary Multiple vulnerabilities were addressed in IBM Bob V 2.1.0 Vulnerability Details CVEID:CVE-2026-12537 DESCRIPTION: Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI versions prior to 0.39.1 and run-gemini-cli GitHub Action versions prior to 0.1.2...

CVE-2026-13745

A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into starting the CLI within an untrusted directory. The vulnerability is triggered via untrusted .env files overriding GEMINICLIHOME to load malicious configuration...

CVE-2026-13745

A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into starting the CLI within an untrusted directory. The vulnerability is triggered via untrusted .env files overriding GEMINICLIHOME to load malicious configuration...

CVE-2026-13745

The Gemini CLI (prior to version 0.39.1 ) and the associated GitHub Action are vulnerable to arbitrary code execution . An unprivileged attacker can achieve this by tricking a victim into starting the CLI within an untrusted directory containing malicious .env files. These files can override GEMI...

EUVD-2026-75326

A vulnerability in the Gemini CLI and associated GitHub Action allowed an unprivileged attacker to achieve an arbitrary code execution in Gemini CLI via untrusted local .env files overriding GEMINICLIHOME...