Skip to content
High-Risk OS Command Injection in ATXP Gemini CLI Extension

High-Risk OS Command Injection in ATXP Gemini CLI Extension

First seen 28 Oct 2026, 02:21 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 04:46 UTC
  • •CVE-2026-117560 is a high-risk OS command injection vulnerability in ATXP Gemini CLI.
  • •Attackers can exploit this flaw by injecting commands through email or SMS content.
  • •Users are advised to disable the extension and monitor for unusual activity until a fix is available.

The ATXP Gemini CLI extension, version 1.0.0, has been identified with an OS command injection vulnerability (CVE-2026-117560) that allows attackers to execute shell commands via unsanitized parameters. This vulnerability affects users who utilize AI CLI assistants linked to email and messaging tools, potentially enabling attackers to manipulate content in messages to execute commands with the user's permissions. The risk is classified as high, with no proof-of-concept or exploitation data currently available, making it difficult to gauge the urgency of the threat. Developers and staff with access to sensitive resources are particularly at risk. Users are advised to review logs for suspicious activity and to disable the extension until a patch is released. The vulnerability was published on October 27, 2026, with a CVSS score of 8.5, indicating a significant threat level.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-27
CVE-2026-117560 published
The vulnerability in ATXP Gemini CLI extension was officially published with a CVSS score of 8.5, marking it as high risk.
www.vulncheck.com

More articles in this cluster (5)

Following this threat?

Track CVE-2026-117560 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 4

Common questions

Who is affected by this vulnerability?
Developers and staff using the ATXP Gemini CLI extension connected to email or messaging tools are most at risk.
What should I do if I'm using the affected extension?
Disable the extension and monitor for any unusual activity until a patch is released.
Is there a patch available for this vulnerability?
No, there is currently no fixed release information provided; users should disable the extension until a patch is available.