Gemini CLI silently executed arbitrary code from an untrusted repo (CVE-2026-12537, CVSS 10.0)
10/10
Severity
Security Vulnerability
Failure Mode
Reproducible
No
Date
July 28, 2026
Expected Behavior
Treat repository-supplied configuration as untrusted; never execute shell commands from a workspace without review or an allowlist.
What Actually Happened
Gemini CLI automatically trusted the current workspace folder and loaded any agent configuration it found there without review or sandboxing. Combined with a --yolo mode that ignored tool allowlists, a malicious repo could silently run arbitrary commands on the host the moment the agent was pointed at it.
Damage Assessment
Tracebit reported the flaw to Google two days after Gemini CLI's June 25, 2026 launch. Classified P1/S1 and assigned CVE-2026-12537 with a perfect CVSS v4 score of 10.0, it exposed thousands of CI/CD pipelines to command injection and supply-chain compromise until it was fixed in v0.1.14.
Full Report
Google released Gemini CLI, an open-source terminal AI agent, on June 25, 2026. Two days later, researchers at Tracebit reported that in its default configuration the agent could silently execute arbitrary malicious code on a user's machine when run against untrusted code. Gemini CLI automatically trusted the current workspace folder and loaded any agent configuration found there without review, sandboxing, or human approval; its --yolo mode additionally ignored tool allowlists and would run any command. Code execution on the host handed an unprivileged outsider access to whatever secrets, credentials, and source code the workflow could reach — a direct path to a supply-chain attack inside CI/CD. Google classified it P1/S1, assigned CVE-2026-12537 with a CVSS v4 score of 10.0, and shipped a fix in v0.1.14.
Incident Metadata
- Agent
- Gemini Cli
- Failure Mode
- Security Vulnerability
- Root Cause
- Tool Misuse
- Task Type
- feature
- Domain
- infra
- Source
- news_report