[CVE-2026-12537] Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versio…

Descripción técnica

Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously crafted .gemini/.env file.

Puntuación CVSS

Score: 7.8/10 — Severidad: HIGH — Estado NIST: Analyzed

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Productos afectados

Gemini-cli, Run-gemini-cli — Google

Debilidades (CWE)

CWE-20, CWE-78

Fuente oficial

Publicado en NIST NVD.