CVE-2026-12537: Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses
Gemini CLI (@google/gemini-cli) and the run-gemini-cli GitHub Action are being updated to harden workspace trust and tool allowlisting, in particular when used in untrusted environments like GitHub Actions.
What it is
Gemini CLI (@google/gemini-cli) and the run-gemini-cli GitHub Action are being updated to harden workspace trust and tool allowlisting, in particular when used in untrusted environments like GitHub Actions. This update introduces a breaking change to how non-interactive (headless) environments handle folder trust, which may impact existing CI/CD workflows under specific conditions.
In previous versions, Gemini CLI running in CI environments (headless mode) automatically trusted workspace folders for the purpose of loading configuration and environment variables. This is potentially risky in situations where Gemini CLI runs on untrusted folders in headless mode (e.g. CI workflows that review user-submitted pull requests). If used with untrusted directory contents, this could lead to remote code execution via malicious environment variables in the local .gemini/ directory.
To ensure consistency and user control, the latest update aligns headless mode behavior with interactive mode, requiring folders to be explicitly trusted before configuration files (such as .env) are processed.
How to check
- Affected: @google/gemini-cli (npm) < 0.39.1.
- Affected: @google/gemini-cli (npm) = 0.40.0-preview.2.
- Affected: google-github-actions/run-gemini-cli (actions) < 0.1.22.
- Compare your installed version with the range above (command below).
How to fix
- Upgrade @google/gemini-cli to 0.39.1 or later.
- Upgrade @google/gemini-cli to 0.40.0-preview.3 or later.
- Upgrade google-github-actions/run-gemini-cli to 0.1.22 or later.
npm ls @google/gemini-cli -g # or: gemini --version
# check google-github-actions/run-gemini-cli version