Elad Meged

**Name of the Vulnerable Software and Affected Versions** Google Gemini CLI versions prior to 0.39.1 run-gemini-cli GitHub Action versions prior to 0.1.22 **Description** An OS command injection flaw exists in the container launcher used by Google Gemini CLI and the run-gemini-cli GitHub Action when operating on headless CI platforms. The issue stems from improper neutralization of input during the parsing and expansion of environment file contents, specifically within a maliciously crafted `.gemini/.env` file. This allows an unprivileged attacker to achieve pre-sandbox host-level remote code execution on the CI runner, which can lead to secret theft, lateral movement, and full pipeline compromise. This occurs before sandboxing is applied, meaning the attacker can execute commands directly on the host system. **Recommendations** Update Google Gemini CLI to version 0.39.1 or later. Update run-gemini-cli GitHub Action to version 0.1.22 or later. For workflows running on trusted inputs, set the environment variable `GEMINI TRUST WORKSPACE` to `true`. For workflows running on untrusted inputs, review hardening guidance to restrict folder trust and avoid automatic processing of configuration files.

**Name of the Vulnerable Software and Affected Versions** pretalx versions prior to 2026.1.0 **Description** The organiser search in the backend renders submission titles, speaker display names, and user names or emails into the result dropdown using innerHTML string interpolation. This allows a user who controls these fields to inject HTML or JavaScript that executes in the browser of an organiser when a search query matches the malicious record. **Recommendations** Update to version 2026.1.0.