Max-Severity RCE Flaw Found in Google Gemini CLI

Why It Matters

The flaw could let attackers hijack CI pipelines, compromising build integrity and potentially exposing production systems. Prompt remediation is critical for any organization that automates code delivery with Gemini CLI.

Key Takeaways

• Gemini CLI RCE flaw rated CVSS 10.0, highest severity
• Vulnerability stemmed from implicit workspace trust in headless CI environments
• Fixed in @google/gemini-cli 0.39.1, 0.40.0-preview.3 and Action 0.1.22
• Updated versions require explicit trust, enforce stricter tool allowlisting
• Users must upgrade and audit configurations to prevent future exploits

Pulse Analysis

The discovery of a critical remote‑code‑execution (RCE) bug in Google Gemini CLI underscores the growing attack surface of developer‑centric tooling. CLI utilities have become integral to modern DevOps, automating everything from code analysis to deployment. When such tools run in non‑interactive, headless modes—common in continuous integration (CI) pipelines—they often inherit implicit trust assumptions that were originally designed for local, interactive use. In Gemini’s case, the CLI automatically trusted workspace folders, loading configuration files without verification, which opened a path for malicious actors to inject payloads that execute directly on the host system.

Technical analysis reveals the flaw aligns with several CWE categories, including CWE‑20 (improper input validation) and CWE‑78 (command injection). Because the exploit required minimal privileges and no user interaction, the CVSS score reached the maximum 10.0, indicating a worst‑case scenario for any organization using the tool in automated workflows. The vulnerability primarily affected headless executions using the “‑‑yolo” mode, where the CLI bypassed its own sandboxing mechanisms. This highlights a broader industry challenge: ensuring that security controls designed for interactive sessions are equally enforced in automated pipelines.

Google’s remediation strategy focuses on removing implicit trust and mandating explicit workspace approval before loading configurations. The patched releases also tighten tool allow‑listing, preventing commands outside the defined scope from running. For enterprises, the immediate action is to upgrade to the fixed versions and audit existing Gemini CLI configurations for unsafe defaults. More broadly, the incident serves as a reminder that CI/CD tooling must be continuously evaluated for trust assumptions, and that supply‑chain security practices—such as pinning dependencies and regularly reviewing third‑party actions—are essential to safeguard the software delivery lifecycle.