Skip to content
Sign in
10.0 Critical

CVE-2026-12537 Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to…

Description

Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously crafted .gemini/.env file.

Affected products and versions

Product Affected versions Fixed in
Gemini CLI 0.39 earliest → < 0.39.1 0.39.1
run-gemini-cli GitHub Action 0.1 earliest → < 0.1.22 0.1.22

Other CVEs of Gemini CLI

The 2 CVEs of Gemini CLI →
CVE-2026-13745 A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by… 7.7 High
Track this CVE