Security Bulletin: Multiple Vulnerabilities in IBM Bob

Summary Multiple vulnerabilities were addressed in IBM Bob V 2.1.0 Vulnerability Details CVEID:CVE-2026-12537 DESCRIPTION: Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI versions prior to 0.39.1 and run-gemini-cli GitHub Action versions prior to 0.1.2...

Duplicate Advisory: Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wpqr-6v78-jr5g. This link is maintained to preserve external references. Original Description Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI versions prior to 0.39.1...

GHSA-JJ69-4GRX-FQJ5 Duplicate Advisory: Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wpqr-6v78-jr5g. This link is maintained to preserve external references. Original Description Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI versions prior to 0.39.1...

CVE-2026-12537

Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI versions prior to 0.39.1 and run-gemini-cli GitHub Action versions prior to 0.1.22 on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously...

EUVD-2026-38790

Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI versions prior to 0.39.1 and run-gemini-cli GitHub Action versions prior to 0.1.22 on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously...

CVE-2026-12537: Improper Input Validation

Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI versions prior to 0.39.1 and run-gemini-cli GitHub Action versions prior to 0.1.22 on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously...

PT-2026-37208

Name of the Vulnerable Software and Affected Versions @google/gemini-cli versions prior to 0.39.1 run-gemini-cli affected versions not specified Description Issues exist in the handling of workspace trust and tool allowlisting when running in headless mode, such as within CI/CD environments. In...