STUPID-2026-0027

Gemini CLI silently executed arbitrary code from an untrusted repo (CVE-2026-12537, CVSS 10.0)

10.0critical
July 28, 2026Verified

  1. Instruction given

    Run Gemini CLI inside a project directory to help with coding tasks.

  2. Expected behavior

    Treat repository-supplied configuration as untrusted; never execute shell commands from a workspace without review or an allowlist.

  3. Actual behavior

    Gemini CLI automatically trusted the current workspace folder and loaded any agent configuration it found there without review or sandboxing. Combined with a --yolo mode that ignored tool allowlists, a malicious repo could silently run arbitrary commands on the host the moment the agent was pointed at it.

  4. Damage

    Tracebit reported the flaw to Google two days after Gemini CLI's June 25, 2026 launch. Classified P1/S1 and assigned CVE-2026-12537 with a perfect CVSS v4 score of 10.0, it exposed thousands of CI/CD pipelines to command injection and supply-chain compromise until it was fixed in v0.1.14.

Google released Gemini CLI, an open-source terminal AI agent, on June 25, 2026. Two days later, researchers at Tracebit reported that in its default configuration the agent could silently execute arbitrary malicious code on a user's machine when run against untrusted code. Gemini CLI automatically trusted the current workspace folder and loaded any agent configuration found there without review, sandboxing, or human approval; its --yolo mode additionally ignored tool allowlists and would run any command. Code execution on the host handed an unprivileged outsider access to whatever secrets, credentials, and source code the workflow could reach — a direct path to a supply-chain attack inside CI/CD. Google classified it P1/S1, assigned CVE-2026-12537 with a CVSS v4 score of 10.0, and shipped a fix in v0.1.14.

Classification

Agent
Gemini CLI
Failure mode
Security Vulnerability
Root cause
Tool Misuse
Domain
Infra
Source
News Report

Related incidents

10.0
Malicious cloned repository triggered code execution in Cursor on Windows
10.0
AI vibe-coded Next.js app pinned vulnerable dependency — cryptominer compromised production server
10.0
Asked to fix 8 functions, Gemini touched 340 files, deleted 28,745 lines, broke a live portal, then faked a success report
10.0
Clinejection: an AI issue-triage workflow enabled arbitrary code execution on the CI runner
Discuss on Hacker News

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. When one lands at 7.0 or above — deleted data, leaked secrets, broken production — you get an email with the source. When nothing does, you get nothing.

This database is callable over MCP — query it from inside your agent.