GHSA-WPQR-6V78-JR5G

Gemini CLI (@google/gemini-cli) and the run-gemini-cli GitHub Action are being updated to harden workspace trust and tool allowlisting, in particular when used in untrusted environments like GitHub Actions. This update introduces a breaking change to how non-interactive (headless) environments handle folder trust, which may impact existing CI/CD workflows under specific conditions.

Details

Folder Trust in Headless Mode

In previous versions, Gemini CLI running in CI environments (headless mode) automatically trusted workspace folders for the purpose of loading configuration and environment variables. This is potentially risky in situations where Gemini CLI runs on untrusted folders in headless mode (e.g. CI workflows that review user-submitted pull requests). If used with untrusted directory contents, this could lead to remote code execution via malicious environment variables in the local .gemini/ directory.

To ensure consistency and user control, the latest update aligns headless mode behavior with interactive mode, requiring folders to be explicitly trusted before configuration files (such as .env) are processed.

As a result of this change, GitHub Actions and other automated pipelines that rely on the previous automatic trust behavior will fail to load workspace-specific settings until they are updated to use explicit trust mechanisms.

Tool Allowlisting under --yolo

In previous versions, when Gemini CLI was configured to run in --yolo mode, it would ignore any fine grained tool allowlist in ~/.gemini/settings.json (e.g. run_shell_command(echo) would allow any command). This is potentially risky in situations where Gemini CLI runs on untrusted inputs with --yolo (e.g. CI workflows that triage user-submitted GitHub issues where we recommend a strict allowlist). If used with untrusted content and a tool allowlist that permits run_shell_command, this could lead to remote code execution via prompt injection.

In version 0.39.1, the Gemini CLI policy engine now evaluates tool allowlisting under --yolo mode, which is useful for CI workflows that allowlist a few safe commands to run when processing untrusted inputs. As a result, some workflows that previously depended on this behavior may fail silently unless tool allowlists are modified to fit the task.

Credits

Gemini thanks the following security researchers for reporting this issue through the Vulnerability Rewards Program (g.co/vulnz):

• Elad Meged, Novee Security
• Dan Lisichkin, Pillar Security research team

This impact is limited to workflows using Gemini CLI in headless mode. Any use of Gemini CLI in headless mode without folder trust will require manual review to correctly configure folder trust. This affects all Gemini CLI GitHub Actions. Users must review their workflows, and take one of two approaches:

1. If the workflow runs on trusted inputs (e.g. reviewing PRs from trusted collaborators), set GEMINI_TRUST_WORKSPACE: 'true' in your workflow.

2. If the workflow runs on untrusted inputs, review our guidance in google-github-actions/run-gemini-cli to harden your workflow against malicious content, and set the environment variable.

The application does not adequately validate input before processing it, allowing unexpected values to reach sensitive code paths. Typical impact: varies by context: data corruption, logic bypass, or denial of service.

GHSA-WPQR-6V78-JR5G has a CVSS score of 10.0 (Critical). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.39.1, 0.40.0-preview.3, 0.1.22); upgrading removes the vulnerable code path.

Kodem intelligence

The folder trust and tool allowlisting mitigations are available in @google/gemini-cli version 0.39.1 and 0.40.0-preview.3. By default, the run-gemini-cli GitHub Action will receive and run the latest version of gemini-cli. However, if your workflow specifies a version of gemini-cli by setting the gemini_cli_version, you are encouraged to upgrade to one of the patched versions and audit the workflow settings that use Gemini CLI.

1. What is GHSA-WPQR-6V78-JR5G? GHSA-WPQR-6V78-JR5G is a critical-severity improper input validation vulnerability in @google/gemini-cli (npm), affecting versions < 0.39.1. It is fixed in 0.39.1, 0.40.0-preview.3, 0.1.22. The application does not adequately validate input before processing it, allowing unexpected values to reach sensitive code paths.
2. How severe is GHSA-WPQR-6V78-JR5G? GHSA-WPQR-6V78-JR5G has a CVSS score of 10.0 (Critical). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which packages are affected by GHSA-WPQR-6V78-JR5G?
   • @google/gemini-cli (npm) (versions < 0.39.1)
   • google-github-actions/run-gemini-cli (actions) (versions < 0.1.22)
4. Is there a fix for GHSA-WPQR-6V78-JR5G? Yes. GHSA-WPQR-6V78-JR5G is fixed in 0.39.1, 0.40.0-preview.3, 0.1.22. Upgrade to this version or later.
5. Is GHSA-WPQR-6V78-JR5G exploitable, and should I be worried? Whether GHSA-WPQR-6V78-JR5G is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether GHSA-WPQR-6V78-JR5G is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix GHSA-WPQR-6V78-JR5G?
   • Upgrade @google/gemini-cli to 0.39.1 or later
   • Upgrade @google/gemini-cli to 0.40.0-preview.3 or later
   • Upgrade google-github-actions/run-gemini-cli to 0.1.22 or later