Google Patches CVSS 10.0 RCE in Gemini CLI Headless Mode

Google has patched a maximum-severity remote code execution flaw in Gemini CLI that affected headless deployments, especially GitHub Actions and other CI/CD workflows. The vulnerability stemmed from overly permissive workspace trust handling that automatically treated active folders as trusted and could load attacker-controlled configuration files and environment variables from local .gemini directories. The issue was independently discovered by Elad Meged of Novee and Dan Lisichkin of Pillar Security, and researchers warned that successful exploitation could expose secrets, credentials, source code, and connected downstream systems.

Google said the issue is addressed in Gemini CLI versions 0.39.1 and 0.40.0-preview.3, but warned that applying the fix may require additional workflow changes to avoid breaking automation. The run-gemini-cli GitHub Action defaults to the latest release, which can disrupt pipelines that depended on the previous implicit trust behavior, while workflows using --yolo mode may fail silently unless tool allowlists are updated to align with the new policy engine. Google is urging organizations to review CI/CD jobs and move to explicit trust settings and compatible allowlists before resuming automated use.