Vulnerabilità · 147 giorni fa

Google Gemini CLI security update

Pillar found a CVSS 10 Gemini CLI --yolo allowlist bypass enabling supply-chain pushes; Google patched v0.39.1; Adversa's TrustFall shows similar auto-approve MCP risks across multiple AI CLIs.

Cronologia

• 7 mag Segnalato da Dark Reading

Fonti

2 fonti che coprono questa storia

• Dark Reading 7 mag

  'TrustFall' Exposes Claude Code Execution Risk

  Malicious repositories can trigger code execution in Claude Code, Cursor CLI, Gemini CLI, and CoPilot CLI with minimal or no user interaction.

• SecurityWeek 7 mag

  Gemini CLI Vulnerability Could Have Led to Code Execution, Supply Chain Attack

  Attackers could inject prompts into a GitHub issue and take over the AI agent designed to automatically triage the issue.

Part of the PlainSec briefing for 2026-05-07

Editions

• Briefing for 2026-05-07

Storie correlate

• Anthropic Claude Code security update