PT-2026-51788 · Google Cloud · Gemini-Cli+1

Devansh Batham + 1 · Publicado 2026-06-24 · Atualizado 2026-06-24 · CVE-2026-12537

Mitre

CVSS v4.0

10

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear

Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously crafted .gemini/.env file.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2026-12537

Produtos afetados

Gemini-Cli

Run-Gemini-Cli Github Action

Referências · 2

• https://github.com/google-github-actions/run-gemini-cli/security/advisories/GHSA-wpqr-6v78-jr5g · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-12537 · Nota de Segurança