CyberRota Analysis
AI-GeneratedA critical vulnerability in the Gemini CLI and related GitHub Action permits unprivileged attackers to execute arbitrary code by manipulating untrusted local .env files that override the GEMINI_CLI_HOME environment variable. This poses a significant risk to users of GitHub who utilize the Gemini CLI, as it could lead to unauthorized access and control over systems. Organizations leveraging these tools should prioritize immediate remediation to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A vulnerability in the Gemini CLI and associated GitHub Action allowed an unprivileged attacker to achieve an arbitrary code execution in Gemini CLI via untrusted local .env files overriding GEMINI_CLI_HOME.