{"id":"CVE-2026-12537","aliases":["CVE-2026-13745","GHSA-wpqr-6v78-jr5g"],"url":"https://o3.security/vulnerability/CVE-2026-12537","summary":"Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses","details":"Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously crafted .gemini/.env file.","published":"2026-06-24T14:17:29.630Z","modified":"2026-09-12T03:55:49.995433997Z","cvss":{"score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":{"score":0.00212,"percentile":0.11691,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"GitHub Actions","name":"google-github-actions/run-gemini-cli","fixedVersion":"0.1.22"},{"ecosystem":"npm","name":"@google/gemini-cli","fixedVersion":"0.39.1"},{"ecosystem":"npm","name":"@google/gemini-cli","fixedVersion":"0.40.0-preview.3"}],"fix":null,"references":[{"type":"FIX","url":"https://github.com/google-github-actions/run-gemini-cli/security/advisories/GHSA-wpqr-6v78-jr5g"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-12T03:55:49.995433997Z"}}