OS Command Injection Vulnerability in ATXP Gemini CLI Extension by ATXP
CVE-2026-117560

8.5HIGH

Key Information:

Vendor

Atxp

Status
Gemini-cli-extension
Vendor
CVE Published:
27 October 2026

What is CVE-2026-117560?

The ATXP Gemini CLI Extension up to version 1.0.0 is susceptible to an OS command injection vulnerability due to unsanitized input from MCP tool parameters. Attackers can exploit this flaw by embedding malicious commands in email or SMS content, aiming to influence parameters such as message_id, subject, or query. As a result, they may execute arbitrary shell commands with the privileges of the user running the application. This vulnerability emphasizes the need for proper input validation and sanitization methods to safeguard against potential exploits.

Affected Version(s)

gemini-cli-extension 0 <= 1.0.0

References

https://github.com/atxp-dev/atxp/issues/15
issue-tracking
https://github.com/atxp-dev/atxp
product
https://github.com/atxp-dev/atxp/blob/4e88b0282b51ae7c22e...
technical-description

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyễn Văn Tiến
.