Google Patches Critical RCE Vulnerability in Gemini CLI and GitHub Actions

#cybersecurity #infosec

Summary

Google patched a critical RCE vulnerability (GHSA-wpqr-6v78-jr5g, CVSS 10.0) in the Gemini CLI and GitHub Action that allowed attackers to execute code via malicious workspace configurations or prompt injection.

Take Action:

If you use Gemini CLI or its GitHub Action in automated workflows (CI/CD pipelines), upgrade immediately to @google/gemini-cli version 0.39.1 (or 0.40.0-preview.3) and the GitHub Action to version 0.1.22. Never set GEMINI_TRUST_WORKSPACE to true for untrusted inputs like external pull requests, and review your tool allowlists in settings.json to block command injection.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines