CVE-2026-13745 in Gemini CLI
Summary
by MITRE • 09/10/2026
A vulnerability in the Gemini CLI and associated GitHub Action allowed an unprivileged attacker to achieve an arbitrary code execution in Gemini CLI via untrusted local .env files overriding GEMINI_CLI_HOME.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/10/2026
The identified vulnerability resides within the Gemini Command Line Interface and its corresponding GitHub Action integration, representing a critical security flaw related to insecure configuration file handling. The core technical issue stems from how the application processes environment variables derived from untrusted local .env files. Specifically, an attacker with access to modify these local configuration files can manipulate the GEMINI_CLI_HOME variable. This manipulation allows the override of the default home directory path used by the Gemini CLI for storing state and configurations. By redirecting this path to a location controlled by the attacker, it becomes possible to inject malicious scripts or binaries that are subsequently executed during normal operation of the tool.
This vulnerability is classified under CWE-94 as Improper Control of Generation of Code (Code Injection). The attack vector relies on the principle of insecure default configurations and insufficient validation of environment variable inputs when they influence critical system paths. When GEMINI_CLI_HOME is overridden, the CLI may load configuration files or initialization scripts from the attacker-specified directory instead of the secure default location. If these loaded files contain executable code or reference external executables that have been replaced by malicious counterparts, the application will execute them with the privileges of the user running the Gemini CLI. This effectively bypasses standard security boundaries because the vulnerability exploits trust in local configuration integrity rather than network-based attacks.
The operational impact is severe, as it leads to arbitrary code execution on the host system where the vulnerable version of Gemini CLI or its GitHub Action runs. For individual developers, this could result in credential theft, data exfiltration, or the establishment of a persistent backdoor on their local development environment. In CI/CD pipelines utilizing the associated GitHub Action, the impact is amplified significantly. An attacker who can influence the build environment's configuration files could achieve remote code execution within the containerized runner, potentially compromising not only the specific job but also other jobs sharing the same runner or accessing shared artifacts and secrets stored in that context. This poses a substantial risk to supply chain security and organizational infrastructure integrity.
Mitigation strategies must focus on restricting write access to critical configuration directories and validating environment variable inputs. Developers should ensure that .env files are not sourced from untrusted locations and implement strict file permission controls so that only authorized processes can modify them. Additionally, the Gemini CLI implementation should be updated to validate or sanitize paths assigned to GEMINI_CLI_HOME, ensuring they resolve within expected safe boundaries rather than arbitrary directories. For users of the GitHub Action, it is crucial to audit workflow files for any injection points and avoid passing untrusted variables into environment configurations that influence application behavior. Regular security audits focusing on CWE-94 patterns in configuration handling are recommended to prevent similar issues across related tools.