CVE-2026-117560 in Gemini Cli Extension
Summary
by MITRE • 10/27/2026
ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows attackers to execute shell commands through unsanitized MCP tool parameters. Attackers can plant instructions in email or SMS content to inject $() or backtick substitutions into parameters like message_id, subject, or query, running commands as the user.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The ATXP Gemini CLI extension version 1.0.0 and earlier contains a critical operating system command injection vulnerability within its runAtxp function. This flaw stems from insufficient input validation and sanitization of parameters passed to underlying shell operations. Specifically, when processing MCP tool inputs such as message_id, subject, or query fields derived from external sources like email bodies or SMS content, the application fails to properly escape special characters that hold significance in command-line interpreters. This lack of rigorous filtering allows an attacker to inject arbitrary shell metacharacters, including subshell execution operators like dollar-parentheses $() and backticks ``, which are then interpreted by the system shell rather than treated as literal string data.
From a technical perspective, this vulnerability represents a classic instance of CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The root cause lies in the direct concatenation or interpolation of user-supplied input into command strings without adequate sanitization mechanisms such as parameterized commands or strict allow-listing of acceptable characters. When a malicious actor crafts a payload containing shell syntax within these fields, the vulnerable function executes it with the privileges of the current user context. This bypasses any intended application-level logic and grants direct access to the underlying operating system command interpreter.
The operational impact of this vulnerability is severe due to its potential for remote code execution via social engineering vectors. Attackers can embed malicious payloads within seemingly innocuous email messages or SMS texts, which are then processed by the CLI extension when a user interacts with them through the Gemini interface. Upon processing these inputs, the application executes the injected commands on behalf of the authenticated user. This capability allows for unauthorized data exfiltration, modification of system files, installation of malware, or use of the compromised host as a pivot point within an internal network. The severity is further amplified by the ease with which such payloads can be delivered through common communication channels that users frequently interact with via command-line tools.
To mitigate this risk, immediate remediation should focus on implementing strict input validation and output encoding practices. Developers must replace direct shell execution calls with safe alternatives that do not invoke a shell interpreter unless absolutely necessary. If shell invocation is required, arguments should be passed as distinct array elements rather than concatenated into a single string to prevent interpretation of special characters. Additionally, implementing an allow-list approach for permitted input patterns in fields like message_id and subject can significantly reduce the attack surface. Organizations relying on this extension should consider disabling it until patches are available or restricting its usage to trusted internal sources only. Regular security audits and static code analysis focused on CWE-78 patterns are recommended to detect similar issues across other components of the software suite.