Critical Gemini CLI Flaw Raises Supply Chain Security Concerns

Gbhackers •Divya • April 27, 2026

Google has rolled out urgent security updates for its Gemini CLI and the accompanying GitHub Action to address a critical vulnerability. Tracked as GHSA-wpqr-6v78-jr5g, this flaw exposes continuous integration and continuous deployment (CI/CD) pipelines to Remote Code Execution (RCE) attacks. Improper handling of workspace trust and tool allowlisting allows malicious actors to compromise automated workflows, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in Google Gemini CLI Exposes CI/CD Pipelines Google has issued urgent security updates for its Gemini CLI and GitHub Action to address a critical vulnerability, identified as GHSA-wpqr-6v78-jr5g. This flaw allows for Remote Code Execution (RCE) attacks due to improper handling of workspace trust and tool allowlisting. The vulnerability affects CI/CD pipelines, potentially compromising automated workflows. The CVSS score for this vulnerability is 9.8, indicating a high level of severity. Users of Gemini CLI prior to version 0.17.2 are particularly at risk. Google has recommended immediate updates to mitigate the risk. The vulnerability was publicly disclosed on April 24, 2026. Security professionals are advised to review their configurations and apply the necessary patches. 14 sources 73

Extracted Entities

Critical Gemini CLI Flaw Raises Supply Chain Security Concerns

The full story

Extracted Entities

Attack Types (2)

MITRE ATT&CK (2)

Tools (2)

Vulnerabilities (1)