Gemini-CLI CVSS 10 RCE: What Cloud Architects Need to Patch Now in CI/CD
Pillar Security disclosed GHSA-wpqr-6v78-jr5g, which Google patched in 0.39.1. Cloud architects and platform teams must now follow suit in their CI/CD…
7 min read
On 16 April 2026, Pillar Security disclosed a vulnerability in the Google Gemini CLI; Google closed it on 24 April under GHSA-wpqr-6v78-jr5g. CVSS score: 10.0. An external pull-request contributor could execute code on a CI runner before the sandbox initialized. If your pipeline stack still runs Gemini CLI 0.38 or older, you have a multi-tenant issue that won’t show up in your own cloud console.
Key Takeaways
- Peak CVSS for an AI CLI in a CI context. The Gemini CLI flaw stitched together two design gaps: headless mode trusted every workspace folder, and –yolo bypassed tool allow-lists. Together they enabled remote code execution.
- CI runners become the front door. An outside pull request was enough to read secrets, credentials and source code before the sandbox spun up. That shifts the attack surface from the developer’s laptop to the build platform.
- Patch exists, but uptake is uneven. Gemini CLI 0.39.1 and google-github-actions/run-gemini-cli 0.1.22 close the path. Skip central patching and old versions will keep running silently in forks and private pipelines.
Related:Platform Engineering Compliance NIS2/DORA / Google Gemini in the Enterprise
What Pillar Security actually demonstrated
What is the Gemini CLI flaw GHSA-wpqr-6v78-jr5g? It’s a remote-code-execution gap in Google’s Gemini CLI and its companion GitHub Action that an external pull-request contributor could weaponize to run commands on the CI runner before the tool sandbox spun up. Google rated it CVSS 10.0-the top severity on the CVSS 3.1 scale. Patched releases are Gemini CLI 0.39.1 and google-github-actions/run-gemini-cli 0.1.22.
The mechanics are far more concrete than a typical CVE write-up. Pillar Security first proved the attack on Google’s own draco repository, then on 20 April directly against the Gemini CLI. The trigger was a pull request carrying tampered workspace contents. In headless mode the CLI treated the workspace folder as trusted without further checks; a local .gemini config file from the PR loaded, and the –yolo flag ignored fine-grained tool allow-lists.
The upshot was a prompt-injection path that led to arbitrary shell commands. The runner saw the sequence as a legitimate AI instruction, the sandbox started too late, and credentials were already harvested. If you run this in an open-source repo where external PRs are routinely tested, you’ve had an open bypass for weeks-with no hint in the audit log.
Why this hurts especially when viewed through the multi-tenant lens
Cloud architects know the CVSS-10 reflex all too well: hands slam on the table, patch plans are drawn up, audits are scheduled. What makes the Gemini-CLI particularly unpleasant is its structural trait-it runs in the CI/CD context with the pipeline’s highly privileged rights. A compromised pipeline can build signed container images, refresh cloud credentials, deploy Helm charts, or tamper with Terraform states.
For those operating in a multi-tenant platform, the sting is sharper. A pipeline job that churns out builds for multiple customers could, in the event of an RCE, shuffle data or build artifacts across unrelated tenants. A job that serves only one tenant but runs on a shared Cloud Run instance hands an attacker a potential lateral-movement foothold.
This isn’t the first hyperscaler CVSS-10 incident this year. CVE-2026-32202 forced CISA in April onto the KEV list, with deadlines and pressure on federal agencies. The lesson is identical: AI CLIs are software like any other build tool and belong in the same patch, audit, and allow-list process.
CI/CD mitigations for cloud teams: what works, what breaks
What breaks
- AI CLIs with –yolo or any “trust-all” mode enabled in CI
- Workspace configs pulled from PRs without an explicit trust step
- Pinning to branch or tag instead of commit SHA
- Shared pipeline identities spanning multiple repos
- Audit logs that omit pre-sandbox phase capture
What works
- Gemini-CLI 0.39.1 / Action 0.1.22 as minimum-version pin
- Workload-Identity Federation instead of long-lived keys
- PR-validation jobs in dedicated tenant isolation
- Tool allow-lists, no global “yolo” flags
- Renovate Bot or Dependabot on AI-CLI versions
The left column isn’t theoretical. If you’ve embedded Gemini-CLI in an Action during the last three months, scan today’s CI run logs for prepped workspace configs that were read immediately before the first tool invocation. Pillar Security offers an indicator-of-compromise list in its published report-drop it straight into your SIEM before the next audit cycle begins.
Workload-Identity Federation is the unsung second lever. A pipeline run that pulls GCP credentials not from a static service-account key, but federates them OIDC-style per run, leaves an RCE attacker with no long-lived token to burn.
Patch schedule: from audit to a clean pipeline
Two weeks is realistic if the platform team focuses on hard-pinning the action version and isn’t simultaneously planning the next platform migration. Teams running multiple tenants will spend weeks three and four tightening tool allowlists per tenant-extra effort, but no new architecture required.
What remains unresolved
Pillar Security reported the bug for a bounty, but did not disclose the payout-standard practice under the Google VRP program and no indicator of severity. More significant is the pattern: AI CLIs are becoming the first line of CI security because they bridge external prompt input straight to shell execution. The next comparable wave will likely land not in a CLI, but in an embedded agent API or LLM-driven build logic.
Patching your Gemini CLI today closes one incident. Rolling out workload identity, tool allowlists, and pre-sandbox audit logging at the same time closes an entire class of risks.
Frequently Asked Questions
Am I affected if I only use Gemini-CLI locally?
The risk in headless CI pipelines is significantly higher than in interactive local use because the trust step is missing there. Locally, the real issue is the –yolo flag. Anyone who hasn’t activated it locally and is running a version below 0.39.1 should still update promptly.
Is a version pin in the GitHub Action sufficient?
Not on its own. Pinning to version 0.1.22 or a specific SHA is the baseline. Beyond that, you need tool allowlists per job and ideally a dedicated runner profile for pull-request validations that doesn’t hold any cloud credentials. Defense in depth isn’t just textbook theory here-it’s operationally critical.
How can I tell if the vulnerability has been exploited in recent weeks?
Pillar Security’s disclosure report includes indicators. In practice, scan your action logs for tampered .gemini configurations loaded immediately before the first tool operation, and shell sub-calls that fall outside the expected allowlist scope. A 30-day SIEM lookback is a reasonable minimum baseline.
What does this mean for multi-tenant platform teams?
Every tenant shares the same patch date. Teams that can roll out the fix centrally via a platform update gain an advantage. Teams allowing tenant-specific pipelines must bump each tenant individually to the patched version and document this for audit purposes.
Is there a direct link to the CISA KEV?
This Gemini-CLI vulnerability is not currently listed in the KEV because Pillar Security disclosed it responsibly and a patch was available before exploitation occurred. That doesn’t rule out future inclusion if exploitation in the wild is documented.
Editor’s Reading Picks
More from the MBF Media Network
MyBusinessFutureWhen AI Productivity Gets Expensive: What Big Tech’s Tool Consolidation Means for DACH Mid-Market FirmsDigital ChiefsFinOps at Corporate Scale: Who Really Controls the Cloud Bill in 2026SecurityTodayTrapDoor: Coordinated Supply-Chain Attack on npm, PyPI and Crates – What CI/CD Teams Must Check NowSource of header image: Pexels / panumas nikhomkhai (px:17489150)
Source of header image: Pexels / panumas nikhomkhai
