Google Gemini CLI RCE: CVSS 10 Flaw Exposes CI/CD to Attack

Google has patched a critical remote code execution (RCE) vulnerability in its Gemini CLI, specifically impacting the @google/gemini-cli npm package and the google-github-actions/run-gemini-cli GitHub Actions workflow. The Hacker News reports this flaw, rated CVSS 10.0, could allow an unprivileged external attacker to inject malicious content as Gemini configuration, leading to arbitrary command execution on host systems.

This isn’t just another bug; it’s a supply chain risk targeting CI/CD pipelines. An attacker exploiting this could compromise build environments, inject backdoors into deployed applications, or exfiltrate sensitive source code and credentials. The implications extend far beyond a single compromised CLI session, potentially affecting entire development and deployment lifecycles.

For defenders, this highlights the persistent challenge of securing developer tooling and CI/CD infrastructure. Even seemingly minor CLI utilities, when integrated into automated workflows, can become high-severity attack vectors if not rigorously secured. The attacker’s calculus here is clear: target the weakest link in the build chain for maximum impact.