{"id":"CVE-2026-54785","aliases":["GHSA-c5px-58j2-7fqp","PYSEC-2026-3574"],"url":"https://o3.security/vulnerability/CVE-2026-54785","summary":"gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode","details":"### Summary\n`consult_gemini_with_files` in **inline mode** read any file path supplied in\nthe `files` argument without confining it to the working `directory`, then\nforwarded the contents to the Gemini CLI. Because the caller also controls\n`query`, the file contents are echoed back through the Gemini round-trip\n(and sent to Google), making this an arbitrary local file read.\n\n### Impact\nAn MCP client — or an LLM that has been prompt-injected into calling the tool —\ncan read **any file the server process can access** (SSH keys, cloud\ncredentials, `.env`, source) and have it disclosed via the tool response.\nNo code execution by itself.\n\n### Affected component\n- Tool: `consult_gemini_with_files(query, directory, files, …)`, `mode=\"inline\"`\n- Sink: `_read_file_for_inline` via `_prepare_inline_payload` in `src/mcp_server.py`\n- The `at_command` mode already confined paths; inline mode did not.\n\n### Root cause\n`_resolve_path` returned an out-of-root path while only nullifying the *display*\nname, and `_prepare_inline_payload` read the file regardless. Absolute paths,\n`..` traversal, and symlink escapes were all accepted.\n\n### Patch\nFixed in **1.3.1**. `_resolve_path` now resolves symlinks and confines via\n`Path.relative_to(root)`; inline mode skips any entry that resolves outside the\nworking directory (the same guard `at_command` already enforced).\n\n### Workarounds\nUpgrade to 1.3.1. Before upgrading, avoid `mode=\"inline\"` with untrusted\n`files` input, or run the server with a restricted-permission user.\n\n### Credit\nReported privately by Zhihao Zhang (WPI).","published":"2026-07-31T22:31:04.190Z","modified":"2026-10-28T02:30:44.706756981Z","cvss":{"score":6.2,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":{"score":0.00151,"percentile":0.04672,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"gemini-bridge","fixedVersion":"1.3.1"}],"fix":{"url":"https://github.com/eLyiN/gemini-bridge/commit/8f3b85afd02b692c4bc974b5176e12fb277ea801","label":"eLyiN/gemini-bridge@8f3b85a"},"references":[{"type":"WEB","url":"https://github.com/eLyiN/gemini-bridge/releases/tag/v1.3.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54785.json"},{"type":"ADVISORY","url":"https://github.com/eLyiN/gemini-bridge/security/advisories/GHSA-c5px-58j2-7fqp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54785"},{"type":"FIX","url":"https://github.com/eLyiN/gemini-bridge/commit/8f3b85afd02b692c4bc974b5176e12fb277ea801"},{"type":"FIX","url":"https://github.com/eLyiN/gemini-bridge/pull/9"},{"type":"PACKAGE","url":"https://github.com/eLyiN/gemini-bridge"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:44.706756981Z"}}