Arbitrary Code Execution in Gemini CLI by Google
CVE-2026-13745

7.7HIGH

Key Information:

Vendor

Google Cloud

Status
Gemini Cli
Vendor
CVE Published:
10 September 2026

What is CVE-2026-13745?

A security issue in the Gemini CLI and its associated GitHub Action allows an unprivileged attacker to execute arbitrary code. This is facilitated through untrusted local .env files that can override the GEMINI_CLI_HOME variable, potentially leading to unauthorized actions within the environment. Users are advised to implement immediate corrective measures to mitigate the risks associated with this vulnerability.

Affected Version(s)

Gemini CLI 0 < 0.39.1

References

https://github.com/google-gemini/gemini-cli/releases/tag/...
https://www.redguard.ch/blog/2026/06/03/advisory-google-g...
https://www.pwned.info/articles/homing-in-on-arbitrary-co...

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Benjamin Faller, Redguard AG
.