CVE-2026-13745: Gemini CLI RCE Vulnerability

CVE-2026-13745 Overview

CVE-2026-13745 is an arbitrary code execution vulnerability in the Google Gemini command-line interface (CLI) and its associated GitHub Action. An unprivileged attacker can achieve code execution by placing an untrusted local .env file that overrides the GEMINI_CLI_HOME environment variable. This override redirects the CLI to attacker-controlled configuration, resulting in execution of arbitrary code within the Gemini CLI process context. The flaw is tracked under CWE-20: Improper Input Validation.

Critical Impact

Attackers who can drop a .env file into a repository or working directory can hijack Gemini CLI execution, leading to full compromise of the CLI process and any credentials or workflows it handles.

Affected Products

• Google Gemini CLI
• google-github-actions/run-gemini-cli GitHub Action (versions prior to v0.1.22)
• CI/CD pipelines and developer workstations invoking the Gemini CLI

Discovery Timeline

• 2026-09-10 - CVE-2026-13745 published to NVD
• 2026-09-10 - Last updated in NVD database
• Patch released - google-github-actions/run-gemini-clirelease v0.1.22 and GHSA-wpqr-6v78-jr5g

Technical Details for CVE-2026-13745

Vulnerability Analysis

The Gemini CLI loads configuration and extension logic from a directory referenced by the GEMINI_CLI_HOME environment variable. The CLI also reads local .env files from the current working directory during startup. An attacker who controls a .env file in a directory the CLI runs from can set GEMINI_CLI_HOME to an attacker-controlled path.

Once the variable is overridden, the CLI loads configuration, extensions, or hook scripts from that attacker-controlled location. The resulting code runs with the privileges of the user or CI runner executing the CLI. In GitHub Actions workflows, this exposes repository secrets, tokens, and build infrastructure.

Root Cause

The root cause is improper input validation [CWE-20]. The Gemini CLI trusts environment variables sourced from repository-local .env files without validating that security-sensitive variables such as GEMINI_CLI_HOME originate from a trusted scope. Local project files are treated with the same authority as user-owned configuration.

Attack Vector

Exploitation requires the victim to invoke the Gemini CLI in a directory containing a malicious .env file. Common delivery paths include pull requests that add or modify .env files, forks running through GitHub Actions, or shared developer environments. The attacker does not need prior authentication to the target system. Refer to GHSA-wpqr-6v78-jr5g for the vendor's technical description.

Detection Methods for CVE-2026-13745

Indicators of Compromise

• Presence of .env files in repository roots or working directories that define GEMINI_CLI_HOME.
• Gemini CLI processes reading configuration files from unexpected paths outside the user's home directory.
• Unexpected child processes spawned by the gemini binary or the run-gemini-cli GitHub Action runner.
• Outbound network connections from CI runners to non-Google endpoints during Gemini CLI execution.

Detection Strategies

• Scan repositories and build workspaces for .env files that set GEMINI_CLI_HOME or other Gemini CLI environment variables.
• Alert on GitHub Actions workflows using run-gemini-cli at versions below v0.1.22.
• Monitor process telemetry for the gemini CLI loading extensions or scripts from world-writable or repository-local paths.

Monitoring Recommendations

• Enable command-line and environment variable logging for CI/CD runners executing AI developer tooling.
• Correlate file-write events for .env files with subsequent Gemini CLI invocations.
• Track outbound DNS and HTTP traffic from CI jobs and baseline expected Gemini API destinations.

How to Mitigate CVE-2026-13745

Immediate Actions Required

• Upgrade google-github-actions/run-gemini-cli to v0.1.22 or later in all workflows.
• Update the Gemini CLI on developer workstations and build agents to the fixed release.
• Audit repositories for committed .env files and remove any that define GEMINI_CLI_HOME.
• Rotate secrets and tokens exposed to affected CI runners during the vulnerable window.

Patch Information

Google released the fix in run-gemini-cli version v0.1.22. See the release notes and the GitHub Security Advisory GHSA-wpqr-6v78-jr5g for full remediation guidance. The patched version prevents untrusted .env files from overriding security-sensitive Gemini CLI environment variables.

Workarounds

• Explicitly set GEMINI_CLI_HOME in the workflow environment before invoking the CLI to prevent local overrides.
• Restrict Gemini CLI execution to trusted branches and disallow workflow runs from untrusted forks.
• Remove or ignore repository-local .env files in CI by unsetting them before the CLI step executes.
• Run the Gemini CLI inside isolated, ephemeral containers with minimal secret exposure.

# Configuration example: pin the action and lock GEMINI_CLI_HOME in GitHub Actions
jobs:
  gemini:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Remove untrusted .env files
        run: find . -name '.env' -type f -delete
      - name: Run Gemini CLI
        uses: google-github-actions/run-gemini-cli@v0.1.22
        env:
          GEMINI_CLI_HOME: ${{ runner.temp }}/gemini-home