CVE Alert: CVE-2026-117560 – atxp – gemini-cli

ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows attackers to execute shell commands through unsanitized MCP tool parameters. Attackers can plant instructions in email or SMS content to inject $() or backtick substitutions into parameters like message_id, subject, or query, running commands as the user.

**Risk verdict:** High risk for affected users; no KEV, SSVC exploitation, PoC or EPSS data is supplied, so urgency cannot be calibrated against those indicators.

**Why this matters:** Successful exploitation can let an attacker run commands with the local user’s permissions, exposing or altering that user’s data and disrupting their work. A realistic route is to place crafted content in a message or email that is later processed by an integrated assistant tool; compromise depends on the user’s account having useful access.

**Most likely attack path:** The attacker needs local access or a way to influence content handled by the extension, but the stated metrics indicate low attack complexity and no additional interaction once the vulnerable tool processes input. Low privileges are required; scope is unchanged, so direct impact is bounded by the user’s account, though accessible credentials or shared resources could enable follow-on movement.

**Who is most exposed:** Developers and staff using AI CLI assistants connected to email, messaging, or other MCP tools are most at risk, especially on workstations with broad repository or cloud access.

Review CLI and MCP logs for shell metacharacters in tool parameters.

Alert on unexpected shell processes spawned by the assistant or its runtime.

Check for unusual child processes, file changes, and outbound connections in affected user sessions.

Mitigation and prioritisation:

Confirm exposure and upgrade to a vendor-fixed release when available; no fixed-release information is provided here.

Until then, disable the extension or affected tools, and avoid processing untrusted message content.

Restrict runtime permissions and access to secrets; review recent activity for signs of command execution.

Test changes in a representative environment before broad deployment.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.