Arbitrary Code Execution in Gemini CLI by Google
CVE-2026-13745

9.2CRITICAL

Key Information:

Vendor

Google Cloud

Status
Gemini Cli
Run-gemini-cli Github Action
Vendor
CVE Published:
10 September 2026

What is CVE-2026-13745?

A security issue in the Gemini CLI and its associated GitHub Action allows an unprivileged attacker to execute arbitrary code. This is facilitated through untrusted local .env files that can override the GEMINI_CLI_HOME variable, potentially leading to unauthorized actions within the environment. Users are advised to implement immediate corrective measures to mitigate the risks associated with this vulnerability.

Affected Version(s)

Gemini CLI 0 < 0.39.1

run-gemini-cli GitHub Action 0 < 0.1.22

References

https://github.com/google-github-actions/run-gemini-cli/r...
https://github.com/google-github-actions/run-gemini-cli/s...

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Benjamin Faller, Redguard AG
.