{"id":"CVE-2026-12537","revision":"7cbd214918fa4b448315d1ea5c22fe30","records":[{"revision":"7cbd214918fa4b448315d1ea5c22fe30","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-12537","aliases":[],"title":"Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows","description":"Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously crafted .gemini/.env file.","state":0,"publishedAt":"2026-06-24T13:37:21.872+00:00","modifiedAt":"2026-06-24T13:53:24.904+00:00","affected":[{"ecosystem":"Vendor product","name":"Gemini CLI","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Google Cloud\",\n                    \"product\": \"Gemini CLI\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"0.39.1\",\n                            \"versionType\": \"custom\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"},{"ecosystem":"Vendor product","name":"run-gemini-cli GitHub Action","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Google Cloud\",\n                    \"product\": \"run-gemini-cli GitHub Action\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"0.1.22\",\n                            \"versionType\": \"custom\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear","score":10,"severity":"CRITICAL"}],"references":["https://github.com/google-github-actions/run-gemini-cli/security/advisories/GHSA-wpqr-6v78-jr5g"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-12537","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-12537","identifiers":["CVE-2026-12537"]},"retained":false,"historicalAffected":[]}],"coverage":[]}