Headless Gemini CLI Turns CI Into Host Compromise Path
Headless CLI workflows can become host-compromise paths before sandboxing ever starts. The broken assumption is that CI is a safe place to auto-load workspace config; in this case, untrusted folder contents could be treated as trusted input and execute commands on the host.
Google fixed the flaw in @google/gemini-cli below 0.39.1, @google/gemini-cli below 0.40.0-preview.3, and google-github-actions/run-gemini-cli below 0.1.22. The issue affects Gemini CLI in headless mode and also led Google to require explicit workspace trust for folder-based config and environment loading.
The risk persists anywhere a CI job runs Gemini CLI against untrusted repositories or pull requests. In those setups, patching removes the bug, but the workflow still needs trust boundaries that stop attacker-controlled config from being loaded automatically.