CVE-2026-12537: Google Gemini CLI RCE Vulnerability

CVE-2026-12537 Overview

CVE-2026-12537 is a command injection vulnerability in the Google Gemini CLI container launcher and the run-gemini-cli GitHub Action. The flaw exists in Google Gemini CLI versions prior to 0.39.1 and the run-gemini-cli GitHub Action versions prior to 0.1.22. An unprivileged attacker can achieve pre-sandbox host-level code execution on headless continuous integration (CI) platforms by supplying a maliciously crafted .gemini/.env file. The vulnerability is tracked under CWE-20: Improper Input Validation.

Critical Impact
Attackers can execute arbitrary OS commands on CI runners before the Gemini sandbox is established, leading to compromise of build environments, secrets, and downstream artifacts.

Affected Products

Google Gemini CLI versions prior to 0.39.1
run-gemini-cli GitHub Action versions prior to 0.1.22
Headless CI platforms invoking the Gemini CLI container launcher

Discovery Timeline

2026-06-24 - CVE-2026-12537 published to the National Vulnerability Database (NVD)
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-12537

Vulnerability Analysis

The vulnerability resides in the container launcher component used by Google Gemini CLI and the associated GitHub Action. The launcher reads configuration from a .gemini/.env file and passes values to an underlying OS command without proper neutralization of shell metacharacters. Because the launcher runs before the Gemini sandbox is initialized, injected commands execute with the privileges of the host process on the CI runner.

The attack is network-reachable in CI contexts because pull requests, forks, and other untrusted contributors can introduce a .gemini/.env file into a repository. When a workflow invokes the affected action, the malicious environment file is processed on the runner and triggers command execution outside the intended container boundary.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-20]. The container launcher concatenates attacker-controllable values from .gemini/.env into a shell-interpreted command line without escaping, quoting, or using parameterized process invocation. This allows shell metacharacters such as ;, &&, |, and command substitution syntax to break out of the intended argument context.

Attack Vector

An attacker submits a pull request or commits a repository containing a crafted .gemini/.env file. When a headless CI job invokes Gemini CLI or the run-gemini-cli GitHub Action, the launcher parses the file and executes the embedded payload on the host before any sandbox is established. The attacker obtains code execution with the permissions of the CI runner, which typically include access to repository secrets, cloud credentials, and the ability to publish artifacts.

No authentication is required for repositories that accept community contributions. The vulnerability description and technical detail are documented in the GitHub Security Advisory GHSA-wpqr-6v78-jr5g.

Detection Methods for CVE-2026-12537

Indicators of Compromise

Presence of .gemini/.env files in repositories that contain shell metacharacters such as $(, `, ;, &&, or | within variable values
CI job logs showing unexpected child processes spawned by the Gemini CLI launcher before container initialization
Outbound network connections from CI runners to unknown hosts during the Gemini setup phase
Unexpected reads of CI secrets, tokens, or environment variables shortly after Gemini CLI invocation

Detection Strategies

Scan repositories and pull request diffs for additions or modifications to .gemini/.env files and inspect values for shell metacharacters
Audit GitHub Actions workflow runs that reference google-github-actions/run-gemini-cli at versions below 0.1.22
Inventory installed Gemini CLI versions across developer workstations and build agents to identify releases below 0.39.1
Review process execution telemetry on CI runners for non-Gemini child processes launched from the container launcher

Monitoring Recommendations

Enable command-line auditing on self-hosted CI runners to capture the full argument vector passed to the launcher
Forward CI runner process and network telemetry to a centralized logging or SIEM platform for retroactive hunting
Alert on creation or modification of .gemini/.env files in protected branches and on untrusted pull requests

How to Mitigate CVE-2026-12537

Immediate Actions Required

Upgrade Google Gemini CLI to version 0.39.1 or later on all developer workstations and CI runners
Upgrade the google-github-actions/run-gemini-cli GitHub Action to version 0.1.22 or later in every workflow that references it
Pin the action to a fixed, verified version using a commit SHA rather than a floating tag
Rotate any secrets, tokens, and cloud credentials previously exposed to CI runners that executed vulnerable versions on untrusted input

Patch Information

Google has released fixed versions: Gemini CLI 0.39.1 and run-gemini-cli GitHub Action 0.1.22. The fixes address the improper neutralization in the container launcher. Refer to the GitHub Security Advisory GHSA-wpqr-6v78-jr5g for full remediation details.

Workarounds

Restrict the run-gemini-cli GitHub Action to trusted workflows only, avoiding pull_request triggers from forks until patched
Block the presence of .gemini/.env files in pull requests from external contributors using repository policy or pre-merge checks
Run Gemini CLI on isolated, ephemeral CI runners with minimal secret scope and no production credentials
Disable the affected action entirely in critical pipelines until the patched version is rolled out

bash

# Pin the patched GitHub Action version in workflow files
# .github/workflows/gemini.yml
jobs:
  gemini:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: google-github-actions/run-gemini-cli@v0.1.22
        with:
          # ensure .gemini/.env from untrusted sources is not honored
          allow-env-file: false