CVE-2026-13745: Gemini CLI RCE — CRITICAL

CISO Take

A flaw in Google's Gemini CLI and its companion GitHub Action lets an unprivileged attacker achieve arbitrary code execution simply by planting a crafted .env file that overrides the GEMINI_CLI_HOME environment variable, redirecting the tool to load attacker-controlled configuration or scripts instead of trusted ones. This matters most for teams running the run-gemini-cli GitHub Action in CI/CD — any workflow that checks out and processes external or PR-originated code becomes a supply-chain entry point, since no privileged access and no unusual user interaction is required beyond the CLI/Action running as intended. There is no CISA KEV listing, no public exploit or scanner template, and no EPSS score yet, but the vendor already shipped a fix (run-gemini-cli v0.1.22) and published a GitHub Security Advisory (GHSA-wpqr-6v78-jr5g), which signals the maintainers consider the untrusted-repo CI pattern realistic. Patch to run-gemini-cli v0.1.22 or later immediately, audit every CI workflow that invokes Gemini CLI against untrusted checkouts (forked PRs, third-party repos), and treat any .env file sourced from an untrusted repository as hostile input that must be stripped or sandboxed before the CLI runs.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Critical severity is warranted: this is unauthenticated, low-complexity arbitrary code execution (CWE-78 command injection reachable via CWE-20 improper input validation of environment configuration) with no privileges required. The primary mitigating factor today is limited real-world exposure data — no KEV listing, no EPSS score, no confirmed public exploit or Nuclei template — but the exploitation path is trivial to reproduce once understood (drop a .env, run the CLI/Action against it), and the CI/CD context (GitHub Action) turns this into a classic 'pwn request' supply-chain vector against any repo accepting external contributions.

How does the attack unfold?

Initial Access

Attacker submits a pull request or otherwise plants a crafted .env file in a repository/directory that will be processed by Gemini CLI or the run-gemini-cli GitHub Action.

AML.T0010.005

Configuration Hijack

Gemini CLI reads the untrusted .env file and the GEMINI_CLI_HOME environment variable is overridden, redirecting the tool to attacker-controlled paths.

AML.T0081

Code Execution

The CLI/Action loads and executes attacker-supplied scripts or configuration from the hijacked home directory, achieving arbitrary code execution.

AML.T0050

Impact

Attacker gains code execution in the developer machine or CI runner context, enabling theft of CI secrets, source code tampering, or lateral movement.

AML.T0025

Initial Access

Attacker submits a pull request or otherwise plants a crafted .env file in a repository/directory that will be processed by Gemini CLI or the run-gemini-cli GitHub Action.

AML.T0010.005

Configuration Hijack

Gemini CLI reads the untrusted .env file and the GEMINI_CLI_HOME environment variable is overridden, redirecting the tool to attacker-controlled paths.

AML.T0081

Code Execution

The CLI/Action loads and executes attacker-supplied scripts or configuration from the hijacked home directory, achieving arbitrary code execution.

AML.T0050

Impact

Attacker gains code execution in the developer machine or CI runner context, enabling theft of CI secrets, source code tampering, or lateral movement.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Gemini CLI	npm	—	No patch
108.6KPushed 3d ago20% patched~0d to patchFull package profile →
Gemini CLI	—	—	No patch

How severe is it?

CVSS 3.1

N/A

EPSS

0.7%

chance of exploitation in 30 days

Higher than 51% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

1) Upgrade run-gemini-cli GitHub Action to v0.1.22 or later immediately and upgrade the Gemini CLI package to the patched release. 2) Audit CI/CD workflows for any job that runs Gemini CLI or the Action against code from forked pull requests or external contributors, and restrict such jobs to require maintainer approval before running. 3) Never allow untrusted repository content (including .env files) to be present in the working directory before invoking Gemini CLI — strip or sandbox environment files sourced from untrusted checkouts. 4) Pin the Action to a specific patched SHA/tag rather than a floating version. 5) Detection: monitor CI runner logs for unexpected GEMINI_CLI_HOME values or Gemini CLI process executions sourcing config from repo-local paths outside the expected home directory.

What does CISA's SSVC say?

DecisionTrack*

Exploitationnone

AutomatableYes

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionSupply ChainAgentPluginAML.T0010.005- AI Agent Tool AML.T0011- User Execution AML.T0050- Command and Scripting Interpreter AML.T0081- Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.4-AI system verification and validation

NIST AI RMF

GOVERN 6.1-Third-party and supply chain risk

OWASP LLM Top 10

LLM03:2025-Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-13745?

A flaw in Google's Gemini CLI and its companion GitHub Action lets an unprivileged attacker achieve arbitrary code execution simply by planting a crafted .env file that overrides the GEMINI_CLI_HOME environment variable, redirecting the tool to load attacker-controlled configuration or scripts instead of trusted ones. This matters most for teams running the run-gemini-cli GitHub Action in CI/CD — any workflow that checks out and processes external or PR-originated code becomes a supply-chain entry point, since no privileged access and no unusual user interaction is required beyond the CLI/Action running as intended. There is no CISA KEV listing, no public exploit or scanner template, and no EPSS score yet, but the vendor already shipped a fix (run-gemini-cli v0.1.22) and published a GitHub Security Advisory (GHSA-wpqr-6v78-jr5g), which signals the maintainers consider the untrusted-repo CI pattern realistic. Patch to run-gemini-cli v0.1.22 or later immediately, audit every CI workflow that invokes Gemini CLI against untrusted checkouts (forked PRs, third-party repos), and treat any .env file sourced from an untrusted repository as hostile input that must be stripped or sandboxed before the CLI runs.

Is CVE-2026-13745 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-13745, increasing the risk of exploitation.

How to fix CVE-2026-13745?

1) Upgrade run-gemini-cli GitHub Action to v0.1.22 or later immediately and upgrade the Gemini CLI package to the patched release. 2) Audit CI/CD workflows for any job that runs Gemini CLI or the Action against code from forked pull requests or external contributors, and restrict such jobs to require maintainer approval before running. 3) Never allow untrusted repository content (including .env files) to be present in the working directory before invoking Gemini CLI — strip or sandbox environment files sourced from untrusted checkouts. 4) Pin the Action to a specific patched SHA/tag rather than a floating version. 5) Detection: monitor CI runner logs for unexpected GEMINI_CLI_HOME values or Gemini CLI process executions sourcing config from repo-local paths outside the expected home directory.

What systems are affected by CVE-2026-13745?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, CLI-based AI coding assistants, CI/CD pipelines integrating AI agents.

What is the CVSS score for CVE-2026-13745?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksCLI-based AI coding assistantsCI/CD pipelines integrating AI agents

MITRE ATLAS Techniques

AML.T0010.005AI Agent Tool

AML.T0011User Execution

AML.T0050Command and Scripting Interpreter

AML.T0081Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.4

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into starting the CLI within an untrusted directory. The vulnerability is triggered via untrusted .env files overriding GEMINI_CLI_HOME to load malicious configuration files and bypass folder trust prompts.

Exploitation Scenario

An attacker opens a pull request against a public repository that uses the run-gemini-cli GitHub Action in its CI pipeline (e.g., for automated code review or PR triage). The PR includes a crafted .env file that overrides GEMINI_CLI_HOME to point at an attacker-controlled directory also included in the PR diff. When the CI workflow runs Gemini CLI against the checked-out code, the tool reads the malicious .env, redirects to the attacker's fake home directory, and loads/executes attacker-supplied scripts or configuration — granting the attacker code execution inside the CI runner, with access to any secrets or tokens available in that pipeline context.

Weaknesses (CWE)

CWE-15External Control of System or Configuration Setting CWE-20Improper Input Validation CWE-78Improper Neutralization of Special Elements used in an OS Command CWE-829Inclusion of Functionality from Untrusted Control Sphere

CWE-15 — External Control of System or Configuration Setting: One or more system settings or configuration elements can be externally controlled by a user.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
[Implementation, Architecture and Design] Because setting manipulation covers a diverse set of functions, any attempt at illustrating it will inevitably be incomplete. Rather than searching for a tight-knit relationship between the functions addressed in the setting manipulation category, take a step back and consider the sorts of system values that an attacker should not be allowed to control.

Source: MITRE CWE corpus.