CVE-2026-26268
CVSS 8 HIGH: cursor is a code editor built for programming with AI. EPSS 0.7% (50th percentile).
Vulnerabilities · 137 days ago
Headless CLI workflows can become host-compromise paths before sandboxing ever starts. The broken assumption is that CI is a safe place to auto-load workspace config; in this case, untrusted folder contents could be treated as trusted input and execute commands on the host.
Google fixed the flaw in @google/gemini-cli below 0.39.1, @google/gemini-cli below 0.40.0-preview.3, and google-github-actions/run-gemini-cli below 0.1.22. The issue affects Gemini CLI in headless mode and also led Google to require explicit workspace trust for folder-based config and environment loading.
The risk persists anywhere a CI job runs Gemini CLI against untrusted repositories or pull requests. In those setups, patching removes the bug, but the workflow still needs trust boundaries that stop attacker-controlled config from being loaded automatically.
CVSS 8 HIGH: cursor is a code editor built for programming with AI. EPSS 0.7% (50th percentile).
3 sources covering this story
Google fixes CVSS 10.0 vulnerability in Gemini CLI
: This CVSS 10.0 RCE vuln has been patched, automatically for some, so better check those workflows
Google fixes CVSS 10.0 vulnerability in Gemini CLI
: This CVSS 10.0 RCE vuln has been patched, automatically for some, so better check those workflows
Google Fixes CVSS 10 Gemini CLI CI RCE and Cursor Flaws Enable Code Execution
Gemini CLI CVSS 10.0 flaw in versions below 0.39.1 enabled RCE in CI workflows, forcing Google to mandate explicit workspace trust.
Critical Gemini CLI Flaw Enabled Host Code Execution, Supply Chain Attacks
An attacker could have planted a malicious configuration to execute commands outside the sandbox.
Part of the PlainSec briefing for 2026-05-01