2026-04-30 · 2026-Q2
Google Gemini CLI CVSS 10.0 Headless RCE
Who wrote the file that runs on open?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- No
- Actor
- Attacker
Target
Gemini CLI (`@google/gemini-cli`) before 0.39.1 and before 0.40.0-preview.3, and the `run-gemini-cli` GitHub Action before 0.1.22
Impact
Maximum-severity remote code execution in CI. Headless mode auto-trusted workspace folders, so a malicious config file in `.gemini/` executed before sandbox init and exposed any secrets, credentials, or source the workflow could reach, enabling token theft and lateral movement
Root cause
Unsafe workspace-trust handling plus a tool-allowlist bypass under `--yolo` mode when processing untrusted pull requests or issues
Sources
Catalog
Cite this: AgentProv incident record: Google Gemini CLI CVSS 10.0 Headless RCE (2026-04-30). https://agentprov.com/incidents/2026-04-30-google-gemini-cli-cvss-10-0-headless-rce
Related
- Also L5 · 2026-10-25Planted AGENTS.md in a Downloads Folder Got Codex to Install Malware; a CLAUDE.md Variant Exposed Claude Code's OAuth TokenL5Config
- Also L5 · 2026-10-21MCP Inspector Advisory Batch: Two Critical Paths From Connecting to a Malicious MCP Server to Local Command ExecutionL5Config
- Also L5 · 2026-10-16Claude Agent SDK: A Crafted Session ID Injects an MCP Server and Runs Commands Past SDK Permissions (CVE-2026-96620)L5Config