STUPID-2026-0027
Gemini CLI silently executed arbitrary code from an untrusted repo (CVE-2026-12537, CVSS 10.0)
Why 9/10
An unprompted code-execution flaw that reached CI pipelines at scale (CVE, CVSS 10.0). Fixed quickly; no confirmed exploitation in the record.
- Scope
- 4/4
- Many organisations or the public: a flaw in a widely used product, mass exposure, a large outage
- Recoverability
- 3/3
- Permanently lost or irreversible, including data that was exposed
- Did it happen
- 1/2
- Demonstrated (proof of concept, reproduction, controlled test or near-miss) with no real victim reported
- Beyond the user
- 1/1
- Production systems, customers or third parties, or credentials and sensitive personal data
The score is the sum of these four factors. How each factor is scored · scored 2026-10-29
Status and what to do
- Affected
- Gemini CLI before v0.1.14, run against an untrusted repository in its default configuration.
- Fix status
- Fixed · Fixed in Gemini CLI v0.1.14, per the linked report.
- Mitigation
- Update Gemini CLI to v0.1.14 or later, and avoid --yolo on code you did not write.
- Last reviewed
- 2026-10-29 · Report a correction to this record
Instruction given
Run Gemini CLI inside a project directory to help with coding tasks.
Expected behavior
Treat repository-supplied configuration as untrusted; never execute shell commands from a workspace without review or an allowlist.
Actual behavior
Gemini CLI automatically trusted the current workspace folder and loaded any agent configuration it found there without review or sandboxing. Combined with a --yolo mode that ignored tool allowlists, a malicious repo could silently run arbitrary commands on the host the moment the agent was pointed at it.
Damage
Tracebit reported the flaw to Google two days after Gemini CLI's June 25, 2026 launch. Classified P1/S1 and assigned CVE-2026-12537 with a perfect CVSS v4 score of 10.0, it exposed thousands of CI/CD pipelines to command injection and supply-chain compromise until it was fixed in v0.1.14.
Full write-up
Google released Gemini CLI, an open-source terminal AI agent, on June 25, 2026. Two days later, researchers at Tracebit reported that in its default configuration the agent could silently execute arbitrary malicious code on a user's machine when run against untrusted code. Gemini CLI automatically trusted the current workspace folder and loaded any agent configuration found there without review, sandboxing, or human approval; its --yolo mode additionally ignored tool allowlists and would run any command. Code execution on the host handed an unprivileged outsider access to whatever secrets, credentials, and source code the workflow could reach — a direct path to a supply-chain attack inside CI/CD. Google classified it P1/S1, assigned CVE-2026-12537 with a CVSS v4 score of 10.0, and shipped a fix in v0.1.14.
Classification
- Agent
- Gemini CLI
- Failure mode
- Security Vulnerability
- Root cause
- Tool Misuse
- Domain
- Infra
- OWASP Agentic Top 10 (our mapping)
- ASI05 Unexpected Code Execution (RCE) list
- MIT AI Risk Repository (our mapping)
- 2.2 AI system security vulnerabilities and attacks taxonomy
- Source
- News Report
Related incidents
Cite this record
StupidLLM. "STUPID-2026-0027: Gemini CLI silently executed arbitrary code from an untrusted repo (CVE-2026-12537, CVSS 10.0)." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0027/ (accessed 2026-10-29). CC BY 4.0.
← STUPID-2026-0026By IDSTUPID-2026-0028 →
Get told when an agent breaks something
We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.
This database is callable over MCP — query it from inside your agent.