Vulnerabilities & Exploits

Headless Gemini CLI Turns CI Into Host Compromise Path

Headless CLI workflows can become host-compromise paths before sandboxing ever starts. The broken assumption is that CI is a safe place to auto-load workspace config; in this case, untrusted folder contents could be treated as trusted input and execute commands on the host.

Google fixed the flaw in @google/gemini-cli below 0.39.1, @google/gemini-cli below 0.40.0-preview.3, and google-github-actions/run-gemini-cli below 0.1.22. The issue affects Gemini CLI in headless mode and also led Google to require explicit workspace trust for folder-based config and environment loading.

The risk persists anywhere a CI job runs Gemini CLI against untrusted repositories or pull requests. In those setups, patching removes the bug, but the workflow still needs trust boundaries that stop attacker-controlled config from being loaded automatically.

3 sources · Apr 30

Timeline

• Apr 30 Reported by The Register Security

Sources

• Apr 30 The Register Security

  Google fixes CVSS 10.0 vulnerability in Gemini CLI

  : This CVSS 10.0 RCE vuln has been patched, automatically for some, so better check those workflows

  original

• Apr 30 The Register Security

  Google fixes CVSS 10.0 vulnerability in Gemini CLI

  original

• Apr 30 The Hacker News

  Google Fixes CVSS 10 Gemini CLI CI RCE and Cursor Flaws Enable Code Execution

  Gemini CLI CVSS 10.0 flaw in versions below 0.39.1 enabled RCE in CI workflows, forcing Google to mandate explicit workspace trust.

  original

Part of the PlainSec briefing for 2026-05-01

Every edition of this story: Headless Gemini CLI Turns CI Into Host Compromise Path

More from today

• SAP Build Packages Turn Install Time Into Theft Time
• PackageKit Auth Bypass Turns Local Users Root
• Soft PLC Backdoors Survive Restarts in CODESYS Runtime