CVE-2026-13745: Gemini CLI RCE — CRITICAL

CISO Take

A flaw in Google's Gemini CLI and its companion GitHub Action lets an unprivileged attacker achieve arbitrary code execution simply by planting a crafted .env file that overrides the GEMINI_CLI_HOME environment variable, redirecting the tool to load attacker-controlled configuration or scripts instead of trusted ones. This matters most for teams running the run-gemini-cli GitHub Action in CI/CD — any workflow that checks out and processes external or PR-originated code becomes a supply-chain entry point, since no privileged access and no unusual user interaction is required beyond the CLI/Action running as intended. There is no CISA KEV listing, no public exploit or scanner template, and no EPSS score yet, but the vendor already shipped a fix (run-gemini-cli v0.1.22) and published a GitHub Security Advisory (GHSA-wpqr-6v78-jr5g), which signals the maintainers consider the untrusted-repo CI pattern realistic. Patch to run-gemini-cli v0.1.22 or later immediately, audit every CI workflow that invokes Gemini CLI against untrusted checkouts (forked PRs, third-party repos), and treat any .env file sourced from an untrusted repository as hostile input that must be stripped or sandboxed before the CLI runs.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Critical severity is warranted: this is unauthenticated, low-complexity arbitrary code execution (CWE-78 command injection reachable via CWE-20 improper input validation of environment configuration) with no privileges required. The primary mitigating factor today is limited real-world exposure data — no KEV listing, no EPSS score, no confirmed public exploit or Nuclei template — but the exploitation path is trivial to reproduce once understood (drop a .env, run the CLI/Action against it), and the CI/CD context (GitHub Action) turns this into a classic 'pwn request' supply-chain vector against any repo accepting external contributions.

How does the attack unfold?

Initial Access

Attacker submits a pull request or otherwise plants a crafted .env file in a repository/directory that will be processed by Gemini CLI or the run-gemini-cli GitHub Action.

AML.T0010.005

Configuration Hijack

Gemini CLI reads the untrusted .env file and the GEMINI_CLI_HOME environment variable is overridden, redirecting the tool to attacker-controlled paths.

AML.T0081

Code Execution

The CLI/Action loads and executes attacker-supplied scripts or configuration from the hijacked home directory, achieving arbitrary code execution.

AML.T0050

Impact

Attacker gains code execution in the developer machine or CI runner context, enabling theft of CI secrets, source code tampering, or lateral movement.

AML.T0025

Initial Access

Attacker submits a pull request or otherwise plants a crafted .env file in a repository/directory that will be processed by Gemini CLI or the run-gemini-cli GitHub Action.

AML.T0010.005

Configuration Hijack

Gemini CLI reads the untrusted .env file and the GEMINI_CLI_HOME environment variable is overridden, redirecting the tool to attacker-controlled paths.

AML.T0081

Code Execution

The CLI/Action loads and executes attacker-supplied scripts or configuration from the hijacked home directory, achieving arbitrary code execution.

AML.T0050

Impact

Attacker gains code execution in the developer machine or CI runner context, enabling theft of CI secrets, source code tampering, or lateral movement.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Gemini CLI	npm	—	No patch
106.9K Pushed 7d ago 25% patched ~0d to patch Full package profile →
Gemini CLI	—	—	No patch

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 23% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

1) Upgrade run-gemini-cli GitHub Action to v0.1.22 or later immediately and upgrade the Gemini CLI package to the patched release. 2) Audit CI/CD workflows for any job that runs Gemini CLI or the Action against code from forked pull requests or external contributors, and restrict such jobs to require maintainer approval before running. 3) Never allow untrusted repository content (including .env files) to be present in the working directory before invoking Gemini CLI — strip or sandbox environment files sourced from untrusted checkouts. 4) Pin the Action to a specific patched SHA/tag rather than a floating version. 5) Detection: monitor CI runner logs for unexpected GEMINI_CLI_HOME values or Gemini CLI process executions sourcing config from repo-local paths outside the expected home directory.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Supply Chain Agent Plugin AML.T0010.005 - AI Agent Tool AML.T0011 - User Execution AML.T0050 - Command and Scripting Interpreter AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.4 - AI system verification and validation

NIST AI RMF

GOVERN 6.1 - Third-party and supply chain risk

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-13745?

A flaw in Google's Gemini CLI and its companion GitHub Action lets an unprivileged attacker achieve arbitrary code execution simply by planting a crafted .env file that overrides the GEMINI_CLI_HOME environment variable, redirecting the tool to load attacker-controlled configuration or scripts instead of trusted ones. This matters most for teams running the run-gemini-cli GitHub Action in CI/CD — any workflow that checks out and processes external or PR-originated code becomes a supply-chain entry point, since no privileged access and no unusual user interaction is required beyond the CLI/Action running as intended. There is no CISA KEV listing, no public exploit or scanner template, and no EPSS score yet, but the vendor already shipped a fix (run-gemini-cli v0.1.22) and published a GitHub Security Advisory (GHSA-wpqr-6v78-jr5g), which signals the maintainers consider the untrusted-repo CI pattern realistic. Patch to run-gemini-cli v0.1.22 or later immediately, audit every CI workflow that invokes Gemini CLI against untrusted checkouts (forked PRs, third-party repos), and treat any .env file sourced from an untrusted repository as hostile input that must be stripped or sandboxed before the CLI runs.

Is CVE-2026-13745 actively exploited?

No confirmed active exploitation of CVE-2026-13745 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-13745?

1) Upgrade run-gemini-cli GitHub Action to v0.1.22 or later immediately and upgrade the Gemini CLI package to the patched release. 2) Audit CI/CD workflows for any job that runs Gemini CLI or the Action against code from forked pull requests or external contributors, and restrict such jobs to require maintainer approval before running. 3) Never allow untrusted repository content (including .env files) to be present in the working directory before invoking Gemini CLI — strip or sandbox environment files sourced from untrusted checkouts. 4) Pin the Action to a specific patched SHA/tag rather than a floating version. 5) Detection: monitor CI runner logs for unexpected GEMINI_CLI_HOME values or Gemini CLI process executions sourcing config from repo-local paths outside the expected home directory.

What systems are affected by CVE-2026-13745?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, CLI-based AI coding assistants, CI/CD pipelines integrating AI agents.

What is the CVSS score for CVE-2026-13745?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksCLI-based AI coding assistantsCI/CD pipelines integrating AI agents

MITRE ATLAS Techniques

AML.T0010.005 AI Agent Tool

AML.T0011 User Execution

AML.T0050 Command and Scripting Interpreter

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.4

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

A vulnerability in the Gemini CLI and associated GitHub Action allowed an unprivileged attacker to achieve an arbitrary code execution in Gemini CLI via untrusted local .env files overriding GEMINI_CLI_HOME.

Exploitation Scenario

An attacker opens a pull request against a public repository that uses the run-gemini-cli GitHub Action in its CI pipeline (e.g., for automated code review or PR triage). The PR includes a crafted .env file that overrides GEMINI_CLI_HOME to point at an attacker-controlled directory also included in the PR diff. When the CI workflow runs Gemini CLI against the checked-out code, the tool reads the malicious .env, redirects to the attacker's fake home directory, and loads/executes attacker-supplied scripts or configuration — granting the attacker code execution inside the CI runner, with access to any secrets or tokens available in that pipeline context.

Weaknesses (CWE)

CWE-20 Improper Input Validation CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-20 — Improper Input Validation: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

[Architecture and Design] Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
[Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).

Source: MITRE CWE corpus.