CVE-2026-12537: Google Gemini CLI Command Injection in .env Files

Technical summary

The vulnerability stems from improper input validation and neutralization of OS command metacharacters in the container launcher component of Google Gemini CLI. The tool fails to properly sanitize user-supplied values from `.gemini` or `.env` files before passing them to shell execution contexts. This allows an attacker to inject shell metacharacters (e.g., pipes, backticks, command substitution) that alter the intended command flow. The pre-sandbox execution context means the injected code runs on the host system before any containerization boundaries are applied, bypassing isolation mechanisms that would otherwise limit damage.

Business impact

Development teams and CI/CD pipelines using Gemini CLI are at direct risk of supply chain compromise. An attacker who gains control of a repository's `.gemini` or `.env` file—through direct compromise, a dependency, or a pull request—can execute arbitrary code on developer workstations and build servers before containers are spun up. This can lead to credential theft, source code exfiltration, poisoning of build artifacts, lateral movement into internal networks, and injection of malicious code into released software. The impact is especially severe for open-source projects where pull requests from untrusted contributors are common.

Affected systems

Google Gemini CLI versions prior to 0.39.1 are vulnerable. The run-gemini-cli GitHub Action is vulnerable in versions prior to 0.1.22. Any developer or CI/CD system using these versions on headless platforms (Linux, macOS, or Windows in automation contexts) is at risk. Projects that accept external contributions or pull requests are at heightened risk because an attacker can introduce a malicious `.gemini` or `.env` file as part of a contribution.

Exploitability

Exploitation requires only that an attacker be able to introduce or modify a `.gemini` or `.env` file in a repository where Gemini CLI will be executed. No special privileges or authentication are needed beyond the ability to commit a file or influence configuration. In open-source projects, this can be as simple as submitting a pull request. In private organizations, it requires either repository write access or the ability to influence a dependency. The requirement for user interaction (UI:R in the CVSS vector) refers to the act of running the tool—a normal, expected operation in CI/CD pipelines that happens automatically. Once a malicious file is in place, exploitation is reliable and deterministic.

Remediation

Immediately upgrade Google Gemini CLI to version 0.39.1 or later, and update the run-gemini-cli GitHub Action to version 0.1.22 or later. For projects unable to upgrade immediately, implement file-level controls: restrict write access to `.gemini` and `.env` files, require code review approval for any changes to configuration files, and use branch protection rules to prevent direct commits to primary branches. Consider running Gemini CLI in isolated container environments even during local development, and audit any `.gemini` or `.env` files already committed to repositories for suspicious content.

Patch guidance

Check your current Gemini CLI version using the tool's version command or inspect your workflow definition for the run-gemini-cli GitHub Action. Update Gemini CLI through your package manager (verify against the vendor's official release notes for version 0.39.1). For GitHub Actions, update the action reference in your workflow YAML from the current version to 0.1.22 or a later stable release. Test the upgraded version in a non-production environment to ensure compatibility with your build pipelines. Google's release notes will detail any breaking changes, though this patch should be compatible with existing workflows.

Detection guidance

Monitor repositories for recently added or modified `.gemini` and `.env` files, particularly in pull requests. Review Git logs for changes to these configuration files in the last 90 days. In CI/CD logs, look for unexpected command execution, shell metacharacters in configuration file output, or commands that deviate from the normal Gemini CLI workflow. If you use GitHub Actions, audit the action version in all workflows using `run-gemini-cli`. Security scanning tools that check for injection patterns in configuration files may flag suspicious entries. Consider using secret scanning to prevent accidental exposure of credentials that might have been exfiltrated via this vulnerability.

Why prioritize this

This vulnerability merits immediate attention because it enables pre-sandbox code execution in development and build infrastructure, which is a critical attack surface. The ease of exploitation (requires only file write access), combined with the high impact (arbitrary code execution on the host), makes it a primary target for supply chain attacks. The presence in CI/CD workflows amplifies risk because a single compromised repository can affect all downstream consumers of that build artifact. The CVSS score of 7.8 (HIGH) reflects the severity, and organizations should patch as an urgent priority rather than a routine update cycle.

Risk score, explained

The CVSS 3.1 score of 7.8 is derived from: Attack Vector (Local)—the attacker must introduce a file into the target system; Attack Complexity (Low)—no special conditions or race conditions required; Privileges Required (None)—any user running the tool can be exploited; User Interaction (Required)—the user must execute the tool, which is a normal and expected action in CI/CD; Scope (Unchanged)—the impact is limited to the user running the tool; Confidentiality, Integrity, and Availability all rated as High—the attacker achieves complete control over the execution context. The score appropriately reflects a serious vulnerability, though the pre-sandbox execution context and supply chain implications may justify elevated priority within your own risk assessment.

Frequently asked questions