Exploitation observed; activity peaked at 4 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously crafted .gemini/.env file.
Priority
CRITICAL
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 2 products
| Date | Total | Labels |
|---|
| 2026-06-24 | 2 | Disclosure1Patch1 |
| 2026-06-25 | 1 | Patch1 |
| 2026-06-29 | 4 | Disclosure1Patch3 |
| 2026-07-04 | 1 | Exploit1 |
| 2026-07-07 | 1 | Patch1 |
| 2026-07-08 | 1 | General1 |
| 2026-07-18 | 2 | Disclosure2 |
| 2026-07-20 | 2 | Active Exploitation1General1 |
| 2026-07-23 | 1 | General1 |
| 2026-08-07 | 2 | Disclosure2 |
| 2026-08-08 | 2 | Disclosure2 |
| 2026-08-21 | 1 | Patch1 |
| 2026-08-26 | 1 | PoC1 |
| 2026-08-29 | 1 | Patch1 |
| 2026-09-09 | 1 | PoC1 |
| 2026-09-15 | 1 | Patch1 |
Btw, CVE-2026-12537 (crit), forgot to post bout it. Reported earlier this year. Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows https://t.co/3j8qXHMOQd
Post summary
The tweet references CVE-2026-12537, noting a critical unauthenticated RCE in Gemini CLI, but offers no PoC, exploit tool details, patch info, or evidence of active exploitation.
A critical CVSS 10 Gemini CLI vulnerability (CVE-2026-12537) allows unprivileged attackers to execute code in GitHub Actions. Patch your workflows now. #GeminiCLI #GitHubActions #Vulnerability #CVE202612537 #CyberSecurity https://securityonline.info/gemini-cli-vulnerability https://t.co/Q6mSAY0s4D
Post summary
The post highlights a critical CVSS 10 vulnerability in Gemini CLI that permits unprivileged code execution in GitHub Actions and urges immediate patching.
1/6 Paradoja: activás el sandbox… y eso es lo que te hackea. CVE-2026-12537 en Gemini CLI: CVSS 10.0. Código del atacante corre en el host ANTES de que el contenedor arranque. Sin prompt injection. Sin hablarle al modelo. https://t.co/mQLxKZsFpk
Post summary
The post highlights a critical Gemini CLI CVE, noting attacker code runs on the host before container launch and links to a PoC.
Gemini CLI の脆弱性 CVE-2026-12537 が FIX：任意のコード実行の恐れ https://iototsecnews.jp/2026/06/29/critical-gemini-cli-vulnerability-lets-attackers-execute-arbitrary-code/ CLI から対話型 AI を操作する Gemini CLI を自動化処理に組み込む際、特定条件下で不正な命令が実行される脆弱性 CVE-2026-12537 が確認されました。背景には、CI/CD などの自動構築環境で、設定ファイルが安全性の確認なしに読み込まれてしまう仕組み上の不備があります。悪用されると、本来許可されないコマンドが実行され、非公開情報の窃取など深刻な影響につながる恐れがあります。関連ツールを最新版へ更新し、設定ファイルの自動読み込みや実行制限を見直すことが重要です。 #CVE202612537 #GeminiCLI #Google #Vulnerability
Post summary
The article reports a disclosed vulnerability (CVE‑2026‑12537) in Gemini CLI that permits arbitrary code execution through insecure configuration file handling, and emphasizes updating the tool and tightening config file processing to mitigate the risk.
CISO Daily Briefing: ServiceNow patched 3 unauth CVSS 10 flaws in its AI Platform — patch now. CVE-2026-12537 (Gemini CLI) & CVE-2026-54316 (Claude Code), both CVSS 10, let one GitHub issue hijack CI. TeamPCP's supply-chain spree still has 500K+ live creds despite arrests. Gov: EU AI Act's GPAI enforcement is live, fines up to 3% global turnover. Strategy: OpenAI's 700 rogue eval-agents self-organized a 4.5-day Hugging Face breach; insurers now rewriting AI-agent policy. https://labs.cloudsecurityalliance.org/ciso-daily-briefing-august-29-2026/
Post summary
The briefing announces that ServiceNow has addressed three critical CVEs in its AI Platform by releasing a patch, while noting brief exploitation details and highlighting the high CVSS scores of the vulnerabilities.
#Analytics #Threat_Research An analytical review of the main cybersecurity events (June 27 - July 04, 2026) 1⃣. Bad Epoll (CVE-2026-46242) https://github.com/J-jaeyoung/bad-epoll // race-condition UaF in the Linux kernel's epoll subsystem 2⃣. Mitigated API authentication bypass for python*org download metadata https://blog.python.org/2026/06/mitigated-api-bypass-for-download-metadata-python-dot-org 3⃣. Exploits for 23 unpatched vulnerabilities in FFmpeg, VLC, Firefox, Docker, PHP, OpenVPN, nmap, libssh2, nghttp2, and 7zip have been disclosed https://github.com/bikini/exploitarium 4⃣. Beware of the license manager: how a Schneider Electric software vulnerability puts industrial facilities at risk https://securelist.com/tr/schneider-electric-cve-2024-2658-vulnerability/120436 5⃣. Apple Hide My Email Vulnerability https://www.404media.co/apple-hide-my-email-vulnerability-reveals-peoples-real-email-addresses 6⃣. DNS Tricks to Load Malware into Cloned Repository https://0din.ai/blog/clone-this-repo-and-i-own-your-machine 7⃣. Google Gemini CLI Vulnerability https://github.com/advisories/GHSA-jj69-4grx-fqj5 // CVE-2026-12537 8⃣. Apache MINA Deserialization Bypass to RCE https://blog.securelayer7.net/cve-2026-42779-apache-mina-deserialization-rce // CVE-2026-42779 affects Apache MINA versions 2.1.0 - 2.1.11 and 2.2.0 - 2.2.6 9. CyberPocket makes cybersecurity alerts easy to understand. Paste an alert, upload a screenshot, or submit a security message, and CyberPocket turns confusing technical details into a clear summary, risk level, next steps, and client-ready ticket notes. Built for individuals, students, IT teams, MSPs, MSSPs, and SOC analysts, CyberPocket helps you triage faster, learn smarter, and respond with confidence. Visit http://cyberpocket.org and turn confusing alerts into clear action. 10. Build smarter AI agents faster. http://www.GenieBot.Store helps you generate production-ready AI agent system prompts for Claude, ChatGPT, OpenAI, Gemini, Mistral, Llama, and custom LLMs. Choose your tier, describe your business, select your platform, and receive a customized prompt built to help your AI agent think, respond, and operate with purpose.
Post summary
The post lists several CVEs, provides links to PoC/exploit repositories, notes a mitigated API bypass, offers some technical details, but reports no active exploitation.
Claude Code CVE-2026-54316 is the most creative exfil trick I've read this year. It doesn't phone home. It leaks your API key through Hugging Face's public download counter, one character at a time. Let me explain why that's nasty. Novee Security dropped this at Black Hat (the talk was Aug 5). Two AI coding agent bugs. Both land right in the CI pipeline you probably run. CVE-2026-54316 (CVSS 9.1), Claude Code. Affects 0.2.54 all the way through 2.1.163. Fixed in 2.1.163, so update now. Here is the part I keep thinking about. The channel is a legit service. Your key gets encoded as download bumps on a public model page. The attacker just reads the counter. No weird domain. No callback to http://evil.com. Your egress logs show traffic to http://huggingface.co. Totally normal. So your "allow-list of trusted domains" does nothing here. http://huggingface.co IS on the allow-list. That is the whole point. The other one is simpler and scarier on paper. CVE-2026-12537 (CVSS 10.0), Gemini CLI. OS command injection via a crafted .gemini/.env file. Drop the file in a repo, the agent reads it on a headless CI host, an unprivileged attacker gets code execution. Full remote code execution (RCE), a perfect 10.0. Fixed in Gemini CLI 0.39.1 / run-gemini-cli 0.1.22. Think about where these actually run. Not a toy. A real one. Say you are a fintech running Claude Code in continuous integration (CI) to auto-triage dependency-bump PRs. The job env holds ANTHROPIC_API_KEY, an npm token, cloud creds. The agent reads untrusted PR contents. See the problem? Building agents into your pipeline? Here is the fix I would ship today. BEFORE (dangerous): // CI job, full secrets in env, open egress env: ANTHROPIC_API_KEY: [long-lived prod key] NPM_TOKEN: [...] // agent can reach any host, key lives for months AFTER (safe): // short-lived scoped key, minted per run, dead in minutes ANTHROPIC_API_KEY: [15-min token, minted at job start] // egress default-deny, and treat "trusted" endpoints as suspect too // pin agent versions, patch on the CVE, not on vibes // alert on odd request patterns to public counter/stats APIs The lesson for me: a leaked key you can barely use beats an airtight allow-list you trusted too hard. ⚠️ Every agent you drop into CI is one more thing reading attacker-controlled text with your secrets sitting right next to it. Two questions for you. Do you actually know every secret sitting in your agent's CI env right now? And if the exfil channel is a domain you already trust, what in your stack would even catch it? #AISecurity #PromptInjection #LLM
Post summary
The post announces new vulnerabilities in Claude Code and Gemini CLI, detailing their mechanics, provides patch information, and recommends mitigations for CI environments.
One GitHub issue → RCE on Claude Code, Gemini CLI, Codex. Novee at Black Hat: the harness, not the model, was the bug. Gemini's "restricted" allowlist was never enforced at runtime. CVE-2026-12537: CVSS 10.0 The code around the agent is the attack surface. #BlackHat2026
Post summary
CVE-2026-12537, rated CVSS 10.0, was disclosed at Black Hat as an RCE stemming from a never‑enforced allowlist on Gemini’s harness, with a PoC referenced in a GitHub issue.
Warning: Critical vulnerability in #Google Gemini CLI GitHub Actions. CVE-2026-12537 CVSS: 10.0. This flaw impacts the CI/CD system and can lead to code execution! #Patch #Patch #Patch More info: https://github.com/google-github-actions/run-gemini-cli/security/advisories/GHSA-wpqr-6v78-jr5g
Post summary
The post announces a critical CVE in Google Gemini CLI with a high CVSS score and urges users to apply the patch, but provides no PoC or exploit details.
Your AI agent sandbox doesn't matter if RCE fires before it starts. Novee just dropped DefCon 2026 research on Google Gemini CLI: CVE-2026-12537, a perfect CVSS 10.0 host-level RCE. Three lines in .gemini/.env. Zero privileges. Zero prompt injection. The blind spot is Pre-Task Authority. Agents load trust, config, and spawn processes before the first token. Prompt defenses never get a turn. The chain on Gemini CLI in CI: 1. GitHub Actions auto-trusts every workspace when CI=true 2. Attacker PR drops .gemini/.env with GEMINI_SANDBOX_PROXY_COMMAND 3. That "egress security" proxy launches via shell:true string concat 4. Host shell splits on ; and exfils GITHUB_TOKEN, GEMINI_API_KEY, OIDC creds before the Docker sandbox even starts Four defenses bypassed by running earlier than all of them. A security feature became the RCE vector. Same pre-task class across vendors: Gemini before sandbox, Claude Code before trust dialog (Check Point Research), Codex MCP auto-launch on directory trust before the model. Patch: Gemini CLI before v0.39.1 / run-gemini-cli before v0.1.22. Google overhauled headless trust so workspace config no longer auto-loads in CI. Primary: https://novee.security/blog/gemini-cli-pre-task-rce/ Audit the code that decides trust and builds the sandbox. The exploit may fire while the boundary is still being built.
Post summary
The post announces a critical CVSS 10.0 RCE vulnerability (CVE-2026-12537) in Google Gemini CLI, details the exploit chain, and provides specific patch versions for remediation.
3/ 대응은 셋이 갈렸다. Claude Code(CVE-2026-54316, 패치 2.1.163)·Gemini CLI(CVE-2026-12537, 패치 0.39.1)는 CVE 받고 코드 패치. Codex는 CVE 없이 워크플로 구조 자체를 바꿨다(분리된 작업·읽기전용 샌드박스).
Post summary
The text focuses on patching CVE-2026-54316 and CVE-2026-12537 with specific version releases, with no exploitation or PoC details.
Vendor. 0day Intel: A critical CVSS 10 Gemini CLI vulnerability (CVE-2026-12537) allows unprivileged
Post summary
A newly identified zero‑day vulnerability CVE‑2026‑12537 with a CVSS score of 10 has been disclosed for the Gemini CLI, allowing unprivileged execution.
CVE-2026-12537. 0day Intel: A critical CVSS 10 Gemini CLI vulnerability (CVE-2026-12537) allows unprivileged
Post summary
The post announces CVE-2026-12537 as a zero‑day, critical (CVSS 10) Gemini CLI vulnerability that allows unprivileged access, but provides no PoC, exploit code, or patch information.
"Google Gemini CLI" və "run-gemini-cli GitHub Action" komponentlərində kritik boşluq (CVE-2026-12537) aşkarlanıb. #MKA #NCA #MilliCERT #Cybersecurity #Kibertəhlükəsizlik #Xəbərdarlıq https://t.co/aUUZQ25KXT
Post summary
The tweet announces the discovery of CVE‑2026‑12537, a critical vulnerability, without providing technical details, PoC, or exploitation information.
Gemini CLI Vulnerability Hits Maximum CVSS 10 Score. A critical Gemini CLI vulnerability (CVE-2026-12537) exposes developer workflows to maximum severity attacks. Google disclosed this CVSS 10 rating flaw recently. #CVE #Gemini #Vulnerability https://t.co/m2z6K5EJ1G
Post summary
The tweet announces that Google has disclosed a CVSS 10-rated vulnerability (CVE‑2026‑12537) in the Gemini CLI, but does not provide details on PoC, exploit, or patch.
他人が書いた文章をAIに読ませたら、APIキーが漏洩。 誰でも書き込めるGitHubの投稿欄に指示を仕込み、読んだAIがその通りに動いた。Black Hatで Claude Code・Gemini CLI・Codex で実証。 外部の書き込みをAIに自動で読ませていないか確認してください。 https://nvd.nist.gov/vuln/detail/CVE-2026-12537 https://t.co/JpuUVX8bvE
Post summary
The post describes a proof‑of‑concept that leverages user‑provided prompts to trick AI models into leaking API keys via a GitHub comment injection, referencing CVE-2026-12537, but does not provide an exploit, patch, or evidence of real‑world use.
Gemini CLI's CVE-2026-12537 lets you run host commands via .gemini/env file. Fixed in 0.39.1. But the real issue? The harness - the code between model and real world - is where these bugs live. Codex had a workflow flaw too.
Post summary
The post announces CVE‑2026‑12537, a vulnerability in Gemini CLI that enables executing host commands through a .gemini/env file, notes that version 0.39.1 fixes the issue, and briefly mentions analogous flaws in the harness and in Codex.
CVE-2026-12537 scored a maximum 10.0 CVSS rating for Google’s Gemini CLI. The vulnerability allowed attackers to achieve OS command injection using nothing more than a GitHub issue comment. https://geopoliticswithkp.blogspot.com/2026/08/it-took-one-stranger-zero-passwords-and.html https://t.co/YvqU6xwL3O
Post summary
CVE-2026-12537 is an OS command injection flaw in Google’s Gemini CLI with a 10.0 CVSS score, exploitable via a GitHub issue comment, but no patch, exploit tool, or evidence of active exploitation is provided.
CVE-2026-12537: Google Gemini CLI Command Injection Vulnerability - What It Means for Your Business and How to Respond https://hubs.li/Q04q0WjG0
Post summary
The text announces Google Gemini CLI command injection vulnerability CVE‑2026‑12537, but provides no proof of concept, exploitation details, patch information, or technical depth.
TRC analysis shows Russian threat actor 'bandcampro' manipulated Google's Gemini CLI to deploy malware and establish C2 infrastructure across a dental clinic network. The attacker exploited CVE-2026-12537 to move laterally and access patient databases. Runtime segmentation could have limited the blast radius of this AI-assisted botnet operation. #ThreatIntel #CloudSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/russian-speaking-hacker-uses-google-gemini-cli-to-control-botnet-of-eight-dental-clinic-pcs
Post summary
The post confirms that threat actor 'bandcampro' used CVE-2026-12537 to move laterally within a dental clinic network after manipulating Google Gemini CLI.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | gemini-cli | - | node.js | - | |
| App | gemini-cli | 0.40.0 | node.js | - | |
| App | run-gemini-cli | - | - | - |