CVE-2026-54316
CVSS 9.1 CRITICAL: claude Code is an agentic coding tool. EPSS 0.5% (43rd percentile).
Vulnerabilities · 52 days ago
The weak point is the wrapper around the coding agent, not the model itself. In default GitHub-triggered workflows, untrusted issue text can reach code that runs with host or workflow authority before the sandbox or validation logic has a chance to stop it.
Novee Security showed that in Google Gemini CLI and Claude Code, a GitHub issue from an account with no repository privileges could reach CI runners, host command execution, or secret exposure in the vendors' default configs. Gemini CLI's CVE-2026-12537 is fixed in 0.39.1, run-gemini-cli in 0.1.22, and Claude Code's CVE-2026-54316 is fixed in 2.1.163; every Claude Code release from 0.2.54 through 2.1.163 is affected.
The pattern matters beyond these two CVEs. If outside users can trigger your agent workflow, the control point is the harness and its permissions, because patching the model does not change what the surrounding automation is allowed to do.
CVSS 9.1 CRITICAL: claude Code is an agentic coding tool. EPSS 0.5% (43rd percentile).
CVSS 7.8 HIGH: improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to… EPSS 0.2% (11th percentile).
1 source covering this story
Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets
Gemini CLI and Claude Code flaws let untrusted GitHub input reach CI workflows, including host command execution and API key exposure.
Part of the PlainSec briefing for 2026-08-08