Critical Google Gemini CLI Flaw Lets Attackers Execute Code on Headless CI Platforms

Gbhackers •Divya • June 29, 2026

A critical vulnerability has been identified in Google’s Gemini CLI and the associated run-gemini-cli GitHub Action. This flaw exposes headless continuous integration (CI) platforms to potential host-level code execution when processing untrusted workspaces. It is tracked as CVE-2026-12537, with the advisory identifying it as GHSA-wpqr-6v78-jr5g. Rated at the maximum severity under CVSS v4, the issue […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Gemini CLI Vulnerability Allows Arbitrary Code Execution A critical vulnerability in Google’s Gemini CLI, tracked as CVE-2026-12537, has been disclosed, enabling attackers to execute arbitrary code in CI/CD environments, particularly within GitHub Actions workflows. This flaw affects versions of @google/gemini-cli prior to 0.39.1 and 0.40.0-preview.3, as well as the google-github-actions/run-gemini-cli. The vulnerability poses a significant risk to headless CI platforms, allowing potential host-level code execution when processing untrusted workspaces. The issue was published on June 24, 2026, and is rated at the maximum severity under CVSS v4. Organizations using affected versions are urged to take immediate action to mitigate the risk. 2 sources 73

Extracted Entities

CVEs (1)

CVE-2026-12537

Platforms (1)

Google Gemini CLI