CVE-2026-12537: Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows

Synopsis

An OS command injection vulnerability affects Google Gemini CLI (versions prior to 0.39.1) and the run-gemini-cli GitHub Action (versions prior to 0.1.22). The flaw sits in the container launcher and can be triggered remotely without any authentication by supplying a maliciously crafted .gemini/.env file, which the launcher processes before the sandbox is established. Successful exploitation gives an attacker full host-level code execution on the CI/CD runner before any sandboxing takes effect. Patched-image rebuilds at versions 0.39.1 and 0.1.22 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker reaches the vulnerable container launcher over the network; any CI runner exposed to untrusted repository input or remote trigger is within scope.

• AuthenticationNot required

  No credentials or account of any privilege level are needed to deliver the malicious .gemini/.env payload.

• Victim interactionNot required

  No user needs to click a link or approve an action; the launcher processes the crafted file automatically during the CI startup sequence.

• Attack complexityDetail

  Exploitation is reliable and condition-free: no race conditions, memory-layout dependencies, or environmental prerequisites are required beyond the ability to supply a crafted .gemini/.env file.

Blast Radius

• Attacker executes arbitrary OS commands on the CI/CD host at the process level before the Gemini sandbox initializes, giving full control of the runner environment.
• Secrets, tokens, and environment variables present on the runner (repository deploy keys, cloud provider credentials, registry passwords) are readable and exfiltrable.
• The attacker can modify build artifacts, inject malicious code into the pipeline output, or tamper with any files the runner process can write.
• Compromise of the runner can pivot into downstream systems reachable from the CI network, including production registries and deployment targets.