Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses
# Summary Gemini CLI (`@google/gemini-cli`) and the `run-gemini-cli` GitHub Action are being updated to harden workspace trust and tool allowlisting, in particular when used in untrusted environments like GitHub Actions. This update introduces a breaking change to how non-interactive (headless) environments handle folder trust, which may impact existing CI/CD workflows under specific conditions. # Details Folder Trust in Headless Mode In previous versions, Gemini CLI running in CI environments (headless mode) automatically trusted workspace folders for the purpose of loading configuration and environment variables. This is potentially risky in situations where Gemini CLI runs on untrusted folders in headless mode (e.g. CI workflows that review user-submitted pull requests). If used with untrusted directory contents, this could lead to remote code execution via malicious environment variables in the local `.gemini/` directory. To ensure consistency and user control, the latest update aligns headless mode behavior with interactive mode, requiring folders to be explicitly trusted before configuration files (such as `.env`) are processed. As a result of this change, GitHub Actions and other automated pipelines that rely on the previous automatic trust behavior will fail to load workspace-specific settings until they are updated to use explicit trust mechanisms. Tool Allowlisting under \--yolo In previous versions, when Gemini CLI was configured to run in `--yolo` mode, it would i
GHSA-wpqr-6v78-jr5g
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-wpqr-6v78-jr5g
@google/gemini-cli
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 0.39.1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
@google/gemini-cli
Source reference: /affected/1/package/name
- Affected versions
- 0.40.0-preview.2
Source reference:
/affected/1/versions - Fixed versions
- 0.40.0-preview.3
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
google-github-actions/run-gemini-cli
Source reference: /affected/2/package/name
- Affected versions
- v0.1.21
Source reference:
/affected/2/versionsv0.1.20Source reference:
/affected/2/versionsv0.1.19Source reference:
/affected/2/versionsv0.1.18Source reference:
/affected/2/versionsv0.1.17Source reference:
/affected/2/versionsv0.1.16Source reference:
/affected/2/versionsv0.1.15Source reference:
/affected/2/versionsv0.1.14Source reference:
/affected/2/versionsv0.1.13Source reference:
/affected/2/versionsv0.1.12Source reference:
/affected/2/versionsv0.1.11Source reference:
/affected/2/versionsv0.1.10Source reference:
/affected/2/versionsv0.1.9Source reference:
/affected/2/versionsv0.1.8Source reference:
/affected/2/versionsv0.1.7Source reference:
/affected/2/versionsv0.1.6Source reference:
/affected/2/versionsv0.1.5Source reference:
/affected/2/versionsv0.1.4Source reference:
/affected/2/versionsv0.1.3Source reference:
/affected/2/versionsv0.1.2Source reference:
/affected/2/versionsv0.1.1Source reference:
/affected/2/versions - Fixed versions
- 0.1.22
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.39.1"
}
]
}
],
"package": {
"name": "@google/gemini-cli",
"purl": "pkg:npm/%40google/gemini-cli",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-wpqr-6v78-jr5g/GHSA-wpqr-6v78-jr5g.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0.40.0-preview.2"
},
{
"fixed": "0.40.0-preview.3"
}
]
}
],
"package": {
"name": "@google/gemini-cli",
"purl": "pkg:npm/%40google/gemini-cli",
"ecosystem": "npm"
},
"versions": [
"0.40.0-preview.2"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-wpqr-6v78-jr5g/GHSA-wpqr-6v78-jr5g.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.1.22"
}
]
},
{
"repo": "https://github.com/google-github-actions/run-gemini-cli",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "f77273f4c914e4bf38440cf36a0369cb64a37489"
}
]
}
],
"package": {
"name": "google-github-actions/run-gemini-cli",
"ecosystem": "GitHub Actions"
},
"versions": [
"v0.1.21",
"v0.1.20",
"v0.1.19",
"v0.1.18",
"v0.1.17",
"v0.1.16",
"v0.1.15",
"v0.1.14",
"v0.1.13",
"v0.1.12",
"v0.1.11",
"v0.1.10",
"v0.1.9",
"v0.1.8",
"v0.1.7",
"v0.1.6",
"v0.1.5",
"v0.1.4",
"v0.1.3",
"v0.1.2",
"v0.1.1"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-wpqr-6v78-jr5g/GHSA-wpqr-6v78-jr5g.json"
}
}
]- Related CVEs
- CVE-2026-12537
Source reference:
/aliases
Publisher severity
critical
Source reference: /database_specific/severity
- Event
- #14881 · Revision 1
- Added to Heist Feed
- Publisher date