Critical Security Alert: RCE Vulnerabilities in Google’s Gemini CLI and GitHub Actions

Google has issued an urgent security advisory following the discovery of critical vulnerabilities within the Gemini CLI and its integrated GitHub Action. These flaws, which pose a direct threat to the integrity of automated development lifecycles, necessitate immediate patching to prevent unauthorized access to sensitive build environments.

Registered under GHSA-wpqr-6v78-jr5g, the vulnerability facilitates Remote Code Execution (RCE) within Continuous Integration and Continuous Deployment (CI/CD) pipelines. By exploiting improper handling of workspace trust and a failure in tool allowlisting mechanisms, malicious actors could potentially hijack automated workflows, representing a high-impact software supply chain attack.

Deep Dive: Analyzing the Technical Attack Vectors

The vulnerability is not a single oversight but rather a confluence of two distinct architectural bypasses within the Gemini CLI environment. In non-interactive, “headless” deployment scenarios—typical of GitHub Actions—the tool’s default behavior prioritized automation over security, granting excessive privileges to the environment.

In-depth analysis by security researchers Elad Meged (Novee Security) and Dan Lisichkin (Pillar Security) revealed three primary exploitation pathways:

• Implicit Workspace Trust in Headless Mode: To streamline automation, the CLI’s headless mode automatically trusted workspace folders. This allowed attackers to trigger code execution by injecting malicious environment variables into untrusted directories that the CLI would then process with high authority.
• Bypassing Tool Allowlisting via ‘Yolo’ Mode: The “Yolo” execution mode—designed for rapid, unrestrained execution—effectively ignored fine-grained tool allowlists. This allowed attackers to utilize prompt injection techniques to bypass security restrictions and achieve RCE.
• Insufficient Input Sanitization: A fundamental failure in input validation meant that special characters and command delimiters were not properly neutralized, providing a direct conduit for operating system command injection.

The Supply Chain Risk: Why This Matters

This vulnerability is particularly dangerous because of how modern development teams operate. Many CI/CD pipelines are configured to automatically triage pull requests or scan public GitHub issues to accelerate development.

If a workflow is configured to run the vulnerable Gemini CLI against code submitted by an unverified external contributor, the system may automatically ingest and execute malicious configuration files. This creates a “zero-click” pathway where an attacker can execute arbitrary code on a build server without requiring elevated permissions or any manual intervention from a developer.

A successful compromise could lead to catastrophic outcomes, including:

• Secret Exfiltration: Stealing repository secrets, API keys, and cloud credentials stored in the CI/CD environment.
• Code Injection: Altering the application’s source code to include backdoors before it reaches production.
• Lateral Movement: Using the build server as a pivot point to penetrate deeper into an organization’s internal network infrastructure.

Remediation Strategies and Patch Deployment

Google has responded by fundamentally re-engineering how the Gemini CLI handles automated tasks. In the patched versions, headless modes have been brought into parity with interactive modes; the CLI no longer assumes trust and requires explicit configuration before processing environment variables or local files.

To secure your environment, DevOps and Security teams should implement the following actions immediately:

• Update Gemini CLI: Ensure all instances of the NPM package are upgraded to version 0.39.1 or the 0.40.0-preview.3 release.
• Patch GitHub Actions: Immediately update the Gemini GitHub Action to version 0.1.22.
• Enforce Explicit Trust: For workflows processing verified, internal inputs, explicitly define the workspace trust environment variable.
• Restrict Tooling: Implement stringent, minimal tool allowlists for any workflow that processes untrusted or external inputs (such as public PRs).
• Audit Current Workflows: Perform a comprehensive scan of all existing GitHub Action YAML files to identify and replace any legacy or pinned versions of the Gemini CLI that fall within the vulnerable range.