Tracking: CVE-2026-12537
Severity: Critical
Who is affected
The affected package lines are:
| Component | Affected | First fixed release |
|---|---|---|
@google/gemini-cli stable |
Before 0.39.1 | 0.39.1 |
@google/gemini-cli preview |
0.40.0-preview.2 | 0.40.0-preview.3 |
google-github-actions/run-gemini-cli |
Before 0.1.22 | 0.1.22 |
How the attack works
Headless execution automatically trusted workspace configuration and environment settings. In a workflow inspecting an untrusted PR, attacker-controlled workspace content could therefore reach code execution. Separately, --yolo could bypass a fine-grained tool allowlist and expose commands through prompt injection.
The risk depends on what the workflow checks out, which tools it permits, and which secrets the runner receives.
What to do
- Upgrade every applicable component. If the action pins
gemini_cli_version, update that pin separately from the action version. - Review the new explicit workspace-trust behavior before restoring failing automation. Do not enable blanket trust for attacker-controlled PR content.
- Review
--yolo, tool permissions, runner secrets, and suspicious workflow activity. Revoke credentials if investigation indicates exposure.
Scope and limits
The trust changes can break existing headless workflows. Resolve those changes with an explicit trust decision for the input being processed.