critical vulnerability

Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses

Fix availableCritical · CVSS 10EPSS 0.21%

Published Apr 24, 2026 · updated Sep 24, 2026

What to do

Upgrade to a fixed version: @google/gemini-cli 0.39.1, @google/gemini-cli 0.40.0-preview.3, google-github-actions/run-gemini-cli 0.1.22.
Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npm@google/gemini-cli227,214 downloads/week

Vulnerable versions: < 0.39.1
Fixed in: 0.39.1

Check your project: npm ls @google/gemini-cli --all

Is @google/gemini-cli@0.39.1 safe to install? See the upgrade verdict →

npm@google/gemini-cli227,214 downloads/week

Vulnerable versions: = 0.40.0-preview.2
Fixed in: 0.40.0-preview.3

Check your project: npm ls @google/gemini-cli --all

Is @google/gemini-cli@0.40.0-preview.3 safe to install? See the upgrade verdict →

GitHub Actionsgoogle-github-actions/run-gemini-cli

Vulnerable versions: < 0.1.22
Fixed in: 0.1.22

Check your project: grep -rn "google-github-actions/run-gemini-cli" .github/workflows

Sources

CWE-20 Improper Input Validation · CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') · CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') · CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

← All critical vulnerabilities