CVE-2026-13745

A critical flaw in Google's Gemini CLI and its associated GitHub Action allows an unprivileged attacker to achieve arbitrary code execution by causing untrusted local .env files to override the GEMINI_CLI_HOME environment variable. The flaw is triggered when Gemini CLI runs in a directory containing a hostile or attacker-controlled .env file, which redirects the tool's home/configuration path and leads to command execution (CWE-20, CWE-78). An attacker gains the ability to run arbitrary code in the context where Gemini CLI executes — a developer workstation, a local project checkout, or a CI runner when triggered via the GitHub Action, potentially exposing source code, credentials, and secrets available to that environment. Affected users are developers and organizations that run Gemini CLI locally or invoke it through the associated GitHub Action in automated workflows. There is no known exploitation, no public proof-of-concept, and the issue is not in CISA's KEV catalog, though the CVSS 4.0 score of 9.2 (critical) with a network vector and high impact on confidentiality, integrity, and availability indicates it is exploitable under the right conditions.

What to do: Upgrade Gemini CLI and the associated GitHub Action to the latest patched releases per Google's advisory, since fixed version numbers are not specified in the available data. Until patched, audit project directories for untrusted .env files before running Gemini CLI, avoid letting untrusted .env files override GEMINI_CLI_HOME, and review GitHub Actions workflows that use the action — restrict GITHUB_TOKEN permissions and pin the action to the patched version to limit blast radius in CI.