CRITICAL 9.2 NVD

CVE-2026-13745

A vulnerability in the Gemini CLI and associated GitHub Action allowed an unprivileged attacker to achieve an arbitrary code execution in Gemini CLI via untrust

A vulnerability in the Gemini CLI and associated GitHub Action allowed an unprivileged attacker to achieve an arbitrary code execution in Gemini CLI via untrusted local .env files overriding GEMINI_CLI_HOME.

References

https://github.com/google-github-actions/run-gemini-cli/releases/tag/v0.1.22
https://github.com/google-github-actions/run-gemini-cli/security/advisories/GHSA-wpqr-6v78

Published: 2026-09-10 · Source: NVD · Feed updated: 2026-09-11

This critical severity vulnerability with a CVSS score of 9.2 was published on 2026-09-10 via NVD.

Risk Timeline

CVE Disclosed2026-09-10 · 0 days ago

Remediation Resources

GitHub

github.com/google-github-actions/run-gemini-cli/releases/tag/v0.1.22

GitHub

github.com/google-github-actions/run-gemini-cli/security/advisories/GH

vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.