IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
10.0Crítica

CVE-2026-12537Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows

Google Cloud Gemini CLI; Google Cloud run-gemini-cli GitHub Action Publicada: (hace 4 meses)

Descripción

Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously crafted .gemini/.env file.

Debilidad (CWE): CWE-20CWE-78

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
google gemini-cli < 0.39.1
google run-gemini-cli < 0.1.22
Google Cloud Gemini CLI < 0.39.1
Google Cloud run-gemini-cli GitHub Action < 0.1.22

Referencias y parches

Coincidencias CPE (NVD) (3)
  • cpe:2.3:a:google:gemini-cli:*:*:*:*:*:node.js:*:* < 0.39.1
  • cpe:2.3:a:google:gemini-cli:0.40.0:preview2:*:*:*:node.js:*:*
  • cpe:2.3:a:google:run-gemini-cli:*:*:*:*:*:*:*:* < 0.1.22