External risk intelligence

Gemini CLI Arbitrary Code Execution via .env Override

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-13745

The vulnerability affects a command-line interface (CLI) tool and a GitHub Action, which are developer-oriented tools typically used in local development environments or isolated CI/CD pipelines. They are not designed to be public-facing network services or internet-accessible gateways.

OS Command Injection

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the Gemini CLI and its associated GitHub Action. This issue could allow an attacker to execute arbitrary code by manipulating local environment files, potentially impacting systems that integrate with these tools. The primary concern is to confirm if our environment utilizes these specific developer tools.

Unprivileged code execution via Gemini CLI.
Relevant for developers using Gemini CLI.
Confirm if Gemini CLI or GitHub Action is used.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by tricking a user into running a malicious .env file with the Gemini CLI. This .env file could contain commands that override the tool's default configuration, allowing the attacker to execute arbitrary code on the user's system, potentially leading to broader compromise.

No privileges needed to start.
Loading a malicious .env file.
Arbitrary code execution risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unprivileged attacker to execute arbitrary code on a system that uses the Gemini CLI and the associated GitHub Action. This could occur when the CLI processes untrusted local `.env` files, potentially overriding the `GEMINI_CLI_HOME` environment variable. The risk is highest when the Gemini CLI is used in contexts where it might encounter or process `.env` files from untrusted sources.

System data could be compromised.
Arbitrary code execution may occur.
Sensitive information exposure is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the Gemini CLI and its associated GitHub Action, suggesting that development teams, platform engineers, and potentially security operations teams managing CI/CD pipelines are the primary stakeholders. The initial step should be to identify all instances of the Gemini CLI and the GitHub Action within your environment, assess their exposure, and confirm business criticality to prioritize remediation efforts.

Identify development and CI/CD teams as owners.
Verify Gemini CLI and GitHub Action usage.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Gemini CLI?

The Gemini CLI is a command-line utility used by developers to interact with Gemini services directly from their terminal. It is frequently paired with a GitHub Action to automate these interactions within continuous integration and deployment (CI/CD) pipelines, helping teams streamline their development workflows and integrate Gemini capabilities into their automated build processes.

What does CVE-2026-13745 mean?

This CVE describes a security weakness where the Gemini CLI improperly handles configuration inputs. Technically classified as Improper Input Validation (CWE-20) and OS Command Injection (CWE-78), the flaw allows the software to be tricked into running unauthorized commands. This happens because the tool does not safely verify the source of environment variables, specifically when it allows an untrusted .env file to override its home directory settings.

How is the Gemini CLI vulnerability triggered?

The issue occurs when the Gemini CLI loads a malicious .env file that modifies the GEMINI_CLI_HOME variable. It is important to note that the vulnerability is not triggered simply by having the tool installed; it requires the active processing of an untrusted or maliciously crafted environment file during execution. Legitimate, trusted configuration files used in standard, secured development environments do not trigger this behavior.

Is my environment at risk from this CVE?

According to Halo Surface Signal, this vulnerability is considered very unlikely to be exposed to the internet. Because the Gemini CLI and its associated GitHub Action are developer-oriented tools typically used in local development setups or isolated, private CI/CD pipelines, they are not standard public-facing network services. The risk is primarily focused on internal environments where these developer tools are actively in use.

What should I do if I use Gemini CLI?

Your first step is to perform an inventory of your development and CI/CD environments to confirm where the Gemini CLI or its GitHub Action is deployed. Once identified, consult the official project release notes to verify if your current version is affected and apply the recommended updates. Focus your remediation efforts on environments where these tools might process configuration files from untrusted sources.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.