Google Patches Critical CVSS 10.0 Vulnerability in Gemini CLI Exposing CI/CD Pipelines

Google Addresses Maximum Severity Flaw in Gemini CLI

Google has patched a CVSS 10.0 vulnerability in Gemini CLI, its command-line AI tool, after security researchers discovered a critical security flaw that could enable remote code execution in CI/CD pipelines. The update, published last week but gaining attention after Novee Security released its detailed writeup on Wednesday, addresses an infrastructure-level issue tied to over-permissive workspace trust settings in headless CI environments 1

1

2

2

.

The vulnerability affects the @google/gemini-cli npm package versions below 0.39.1 and 0.40.0-preview.3, as well as the google-github-actions/run-gemini-cli GitHub Actions workflow versions below 0.1.22. Novee Security researcher Elad Meged, who discovered the flaw independently of Pillar Security's Dan Lisichkin, emphasized that this was not a prompt injection issue but rather an infrastructure-level vulnerability where attacker-controlled content was silently accepted as trusted configuration and executed before any sandbox was initialized 1

1

.

How the Critical Security Flaw Enabled Supply-Chain Attacks

The root cause stems from how headless mode of Gemini CLI handles workspace folders. In previous versions, the tool automatically trusted any workspace folders it operated in for the purpose of loading configuration files and environment variables. This automatic trust mechanism created a dangerous attack vector in CI/CD pipelines, particularly those reviewing user-submitted pull requests or processing untrusted inputs 2

2

.

According to Google's security advisory published to GitHub, if used with untrusted directory contents, this could lead to remote code execution via malicious environment variables in the local .gemini/ directory 1

1

. The vulnerability allowed unprivileged external attackers to force their own malicious configurations to load as Gemini configuration, triggering code execution directly on the host system and bypassing security measures 2

2

.

Novee Security's testing revealed devastating results across every workflow examined. "Code execution on the host running the agent gave an unprivileged outsider access to whatever secrets, credentials, and source code the workflow could reach," the research team explained. "Enough for token theft, supply-chain pivots, and lateral movement into downstream systems" 1

1

.

Implementing Explicit Folder Trust and Update Workflows

The patches shipped in Gemini CLI versions 0.39.1 and 0.40.0-preview.3 bring headless mode into alignment with interactive mode behavior, which already required users to explicitly trust a folder before workspace configuration files are loaded 1

1

. However, the fix creates immediate challenges for developers using AI-driven development tools in automated environments.

The run-gemini-cli GitHub Action defaults to the newest Gemini CLI release unless users pin a specific version, meaning many workflows may have automatically updated but now require manual configuration changes 1

1

. Google urges users to review their workflows and adopt one of two approaches: if the workflow runs on trusted inputs from trusted collaborators, set GEMINI_TRUST_WORKSPACE: 'true' in the workflow; if processing untrusted inputs, review Google's hardening guidance and implement appropriate trust mechanisms 2

2

.

Changes to Tool Allowlisting and Policy Engine Behavior

Google also modified how the policy engine handles tool allowlisting when Gemini CLI runs in --yolo mode, which previously bypassed fine-grained tool allowlists and automatically approved agent actions without prompting. In version 0.39.1, the Gemini CLI policy engine now evaluates tool allowlisting under --yolo mode to prevent scenarios where untrusted inputs could lead to remote code execution via prompt injection 2

2

.

"In previous versions, when Gemini CLI was configured to run in --yolo mode, it would ignore any fine grained tool allowlist," Google explained in the advisory. "As a result, some workflows that previously depended on this behavior may fail silently unless tool allowlists are modified to fit the task" 1

1

. This change addresses the risk of unauthorized access through auto-approved shell commands when processing user-submitted GitHub issues or other untrusted content.

While a CVE hasn't been issued yet, Google has confirmed it is in the process of assigning one. Novee Security also received a bug bounty for the discovery, though the amount was not disclosed 1

1

. The incident highlights the expanding attack surface as AI agents increasingly operate in sensitive CI/CD environments, underscoring the need for developers to fully understand the risks before deploying AI tools in production pipelines.