Google's fix for critical Gemini CLI bug might break your CI/CD pipelines
Google has patched a critical CVSS 10.0 remote code execution vulnerability in the Gemini CLI that could allow malicious code execution in untrusted environments, particularly affecting CI/CD pipelines running in headless mode. The fix, which automatically trusts workspace folders for configuration loading, may break existing workflows that rely on the previous behavior. Users are advised to review and update their configurations to maintain security and functionality.
Opening excerpt (first ~120 words) tap to expand
Patches Google's fix for critical Gemini CLI bug might break your CI/CD pipelines This CVSS 10.0 RCE vuln has been patched, automatically for some, so better check those workflows Brandon Vigliarolo Thu 30 Apr 2026 // 17:15 UTC If you use Gemini CLI, watch out: Google has patched a CVSS 10.0 vulnerability in its command-line AI tool and is warning anyone running it in headless mode, or through GitHub Actions, to review their workflows. The update to Gemini CLI and the run-gemini-cli GitHub Action, published last week but largely unnoticed until one of the two credited research teams published its writeup on Wednesday, fixes a critical - and apparently easy-to-abuse - flaw tied to over-permissive workspace trust settings.
…
Excerpt limited to ~120 words for fair-use compliance. The full article is at The Register.
Discussion
0 commentsMore from The Register
