Gemini CLI Enterprise Security: CVSS 10.0 RCE Guide 2026

Gemini CLI enterprise security became a board-level conversation in April 2026 when Google patched a CVSS 10.0 remote code execution vulnerability that put every organization running Gemini CLI in CI/CD pipelines at risk of complete pipeline compromise. This guide covers the anatomy of CVE-2026-12537, the "Comment and Control" prompt injection chain that affects even patched versions, API key scope expansion risk, and the hardening steps that turn a dangerous default configuration into a defensible enterprise deployment.

What Gemini CLI Is and Why Enterprises Are Adopting It

Google's Gemini CLI is an open-source, terminal-based AI coding assistant that connects directly to Gemini models. Unlike the Gemini API accessed through REST calls, Gemini CLI runs as an autonomous agent with direct access to a repository's file system, the ability to execute shell commands, and integration with external tools through the Model Context Protocol.

Enterprise adoption accelerated through two vectors. First, individual developers began using Gemini CLI locally for code generation, review, and refactoring, treating it as an interactive coding partner. Second, and more consequentially for security teams, the google-github-actions/run-gemini-cli GitHub Action brought Gemini CLI into automated CI/CD pipelines. Teams configured it to automatically review pull requests, generate release notes, analyze test failures, and submit issue comments without human intervention.

This second adoption pattern is where risk concentrated. Automated pipelines process untrusted inputs by design: pull requests from external contributors, issue comments from anyone with repository access, and code from forked repositories. When Gemini CLI processes untrusted content with CI-level permissions, the attack surface expands significantly beyond what most DevSecOps teams anticipated when they enabled the Action.

CVE-2026-12537 Anatomy: How a CVSS 10.0 RCE Works in Practice

CVE-2026-12537, tracked under GitHub Security Advisory GHSA-wpqr-6v78-jr5g, was independently discovered by Elad Meged of Novee Security and Dan Lisichkin of Pillar Security through Google's Vulnerability Rewards Program. Google assigned it CVSS 3.1 score 10.0, the maximum possible severity.

The vulnerability had two compounding root causes.

Root Cause 1: Unsafe Workspace Trust in Headless Mode

When Gemini CLI runs in non-interactive mode (as it does in any automated CI pipeline), earlier versions automatically trusted the workspace folder it was given. Configuration files in the .gemini/ directory, including .gemini/settings.json and .gemini/.env, were loaded and executed without verification or user consent.

An attacker who could place a malicious .gemini/settings.json in any repository processed by the CI pipeline could inject arbitrary configuration. This did not require code review approval, repository write access, or any privilege beyond the ability to submit a pull request or trigger a workflow run. An unprivileged external contributor could initiate the attack.

Root Cause 2: --yolo Mode Allowlist Bypass

Gemini CLI's --yolo mode auto-approves tool calls without interactive prompts, which is useful for CI workflows where no human is present. However, in pre-patch versions, --yolo mode also ignored the fine-grained tool allowlist configured in ~/.gemini/settings.json.

Organizations that had carefully configured allowlists restricting which commands Gemini CLI could execute received no protection when --yolo mode was active. The allowlist simply did not apply.

The combination of these two flaws meant that an attacker could deliver a payload through workspace configuration that --yolo mode would execute without restriction. Confirmed impact scenarios included theft of repository secrets, source code modification, pipeline manipulation, and lateral movement through connected infrastructure.

Google patched both issues in Gemini CLI version 0.39.1 and run-gemini-cli version 0.1.22, published April 2026. The fix introduced workspace trust evaluation before loading any workspace configuration, and made tool allowlisting apply in --yolo mode as intended.

One critical deployment note: the run-gemini-cli GitHub Action defaults to the newest CLI release unless a version is pinned explicitly. Organizations using the Action without a version pin may have remained on vulnerable versions after the patch was released, because the Action simply picked up whatever @google/gemini-cli version was newest at the time of workflow execution.

Comment and Control: Prompt Injection via GitHub PR Comments

Independent of the workspace trust vulnerability, Aonan Guan, Zhengyu Liu, and Gavin Zhong disclosed a related attack class in April 2026: Comment and Control, which demonstrated prompt injection via GitHub issue and pull request content against Gemini CLI, Claude Code, and GitHub Copilot.

The technique uses HTML comments in issue bodies that are invisible in GitHub's rendered Markdown view but fully visible to the AI agent parsing the raw text. A payload embedded this way instructs the agent to take adversarial actions while appearing to any human reviewer as harmless whitespace.

For Gemini CLI specifically, the confirmed exfiltration was the GEMINI_API_KEY posted as a public GitHub issue comment. The attack chain proceeds as follows:

An attacker opens a GitHub issue containing a malicious payload inside an HTML comment block.

A Gemini CLI workflow triggered by issue creation parses the issue body, including the hidden HTML comment.

The hidden payload instructs Gemini to retrieve the GEMINI_API_KEY from the CI environment's variables.

Gemini CLI posts a GitHub issue comment containing the key value.

The key is now public and usable by anyone who views the comment.

This attack does not require any vulnerability in patched versions of Gemini CLI. It is a fundamental property of AI agents that parse untrusted text and can call tools with those results. Any organization running Gemini CLI actions triggered by external GitHub events (pull requests, issues, comments from contributors outside the organization) should treat this attack class as an active risk regardless of which CLI version is deployed.

The vendor response was telling: Anthropic internally rated the vulnerability Critical (CVSS 9.3), later adjusted to 9.4. Google paid a $1,337 bug bounty. GitHub paid $500 after initially closing the report as "Informative." None of these bounties reflect the actual business impact of an API key and GitHub token exposed in a public repository comment.

API Key Scope Expansion: The Silent Credential Upgrade

A structurally different risk affects organizations that have enabled Gemini CLI by enabling the Generative Language API on existing GCP projects.

When generativelanguage.googleapis.com is enabled on a GCP project, every API key in that project without explicit API restrictions silently gains Gemini access. This includes keys originally created for Google Maps, Firebase, YouTube Data API, and other unrelated services.

The security consequence is credential scope drift. A key that was considered low-risk because it only accessed public mapping data now authenticates against Gemini endpoints. If that key was previously distributed to third-party services, logged in client-side code, or stored in a less-secure secret store, the blast radius of its exposure expanded without any action by the security team.

One documented incident resulted in $82,314 in Gemini API billing charges in 46 hours from a single compromised legacy key. The organization had enabled the Generative Language API for a new project initiative, not realizing that existing keys in the same GCP project now provided Gemini access. Researchers estimated approximately 3,000 GCP API keys were affected by this silent upgrade behavior at the time of disclosure.

Remediation requires auditing all API keys in every GCP project where the Generative Language API is enabled, restricting each key to only the APIs it legitimately needs in the GCP Console under APIs and Services, then Credentials, and rotating any keys that have been publicly exposed, committed to version control, or distributed to third parties.

BeyondScale's Google Gemini Enterprise Security guide covers API key governance in more detail alongside other Gemini attack surfaces including Workspace Gemini, Vertex AI, and Agent Builder.

MCP Expansion: The Growing Attack Surface

Gemini CLI's attack surface is expanding as Model Context Protocol integration matures. CVE-2026-0755, a CVSS 9.8 command injection vulnerability in gemini-mcp-tool (the utility for integrating Gemini models with MCP services), demonstrated that tooling built around Gemini creates new vulnerability classes independent of the CLI itself. The flaw passes user input directly to a shell without sanitization, meaning any attacker who can influence MCP tool inputs can execute arbitrary OS commands on the host running the MCP server.

More broadly, MCP-connected Gemini deployments introduce attack classes that the OWASP Top 10 for LLM Applications classifies under Insecure Plugin Design and Excessive Agency:

Tool poisoning: A malicious or compromised MCP server returns tool responses containing prompt injection payloads that hijack subsequent agent actions. Gemini treats the tool response as trusted context and acts on embedded instructions.

Over-broad OAuth scopes: MCP server authorization frequently requests more permissions than a given workflow needs, increasing blast radius when a server is compromised or a tool is hijacked.

Trust boundary abuse: Gemini treats all connected MCP servers as trusted by default. A supply chain compromise of any connected MCP server gains the trust level of the entire agent session.

For enterprises planning to adopt Gemini Spark (scheduled for late 2026) with its expanded MCP connector support, these risks will scale with the number of connected tools. Allowlisting which MCP servers Gemini CLI is permitted to connect to and reviewing each server's OAuth scope is a necessary step before any production MCP-connected deployment.

Enterprise Hardening Checklist

The following controls address each of the attack surfaces covered in this guide. Implement them in the order listed: patch first, then configuration, then monitoring.

Patch and Version Pinning

• Pin @google/gemini-cli to version 0.39.1 or later in package.json and lock files. Do not use "latest" in any automated context.
• Pin google-github-actions/run-gemini-cli to version 0.1.22 or later using a full commit SHA in workflow files, not a floating tag like @v1.
• Audit all GitHub Actions workflows for use of the run-gemini-cli action without explicit version pinning.
• Include Gemini CLI in your software composition analysis (SCA) pipeline so future versions are evaluated before adoption.

Workspace Trust Configuration

• Set GEMINI_TRUST_WORKSPACE: 'true' only for workflows running on trusted, internal repositories where all contributors are verified.
• Never set GEMINI_TRUST_WORKSPACE: 'true' for workflows triggered by pull_request events from forks, issue comments from external contributors, or any other untrusted event source.
• Treat any workflow processing external GitHub events as operating in an untrusted workspace, regardless of the repository's overall trust level.

Allowlist and Mode Controls

• Configure tool allowlists in ~/.gemini/settings.json for all CI deployments.
• Verify that allowlists are enforced in --yolo mode after upgrading to version 0.39.1 or later. Confirm by testing with a command outside the allowlist.
• Prefer explicit allowlists over full --yolo mode for production pipelines. Where --yolo mode is operationally required, restrict the permitted tool set to the minimum commands the workflow actually needs.

API Key Governance

• Audit all API keys in every GCP project where the Generative Language API is enabled. Use gcloud services list and cross-reference against the Credentials page.
• Restrict each key using API key restrictions in the GCP Console, specifying only the APIs each key legitimately requires.
• Store GEMINI_API_KEY in GitHub Encrypted Secrets, not in plain environment variables, repository files, or build configuration.
• Rotate any key that has been exposed in logs, committed to version control, or distributed to third parties without restrictions.

Pipeline Isolation

• Run Gemini CLI steps in a dedicated job with a separate service account scoped to minimum required permissions.
• Do not share the GEMINI_API_KEY secret across jobs that also hold other sensitive credentials (GitHub tokens, cloud provider credentials).
• Use GitHub Actions' permissions: block to restrict the GITHUB_TOKEN scope for any job running Gemini CLI. A job processing issue comments does not need contents: write or pull-requests: write.

MCP Server Governance

• Maintain an explicit allowlist of approved MCP servers that Gemini CLI is permitted to connect to in each environment.
• Review OAuth scopes for each MCP server before approval. Reject servers requesting permissions beyond their documented function.
• Keep gemini-mcp-tool and other MCP integration libraries updated and included in vulnerability scanning. CVE-2026-0755 was a CVSS 9.8 command injection in a widely-used MCP integration layer.

Monitoring and Detection

Patching and configuration changes address known vulnerabilities. Ongoing monitoring is necessary to detect novel attacks and verify that controls remain effective under real-world conditions.

CI/CD Log Analysis

• Enable verbose logging for Gemini CLI in CI pipelines and export logs to your SIEM (Chronicle, Splunk, Microsoft Sentinel).
• Alert on Gemini CLI processes spawning child processes outside the configured tool allowlist.
• Monitor for Gemini CLI accessing files outside the repository working directory or reading environment variables beyond those explicitly passed.
• Flag any CI job that posts issue or pull request comments from a job that also has access to secret values. This pattern is the exfiltration mechanism in Comment and Control attacks.

API Usage Anomalies

• Export Cloud Audit Logs for the Generative Language API to BigQuery and forward to your SIEM.
• Alert on: query volume spikes from a single API key, Gemini API access outside normal business hours, unusually high token consumption in short timeframes, and API calls originating from IP addresses outside your CI provider's known ranges.
• Set billing alerts for the Generative Language API project. An unexpected spike is frequently the first indicator of a compromised key, as the $82,314 incident demonstrated.

Secret Scanning and Inventory

• Enable GitHub's secret scanning for GEMINI_API_KEY patterns across all repositories. Review the alert backlog for any historical exposures.
• Add Gemini API key patterns to your SIEM's secret detection rules for log analysis.
• Run periodic audits of repository git history to detect accidental past commits of API keys, using tools like trufflehog or gitleaks.

Who Is Most Exposed

Organizations with the highest exposure from CVE-2026-12537 and the Comment and Control attack class share a few characteristics: they enabled the run-gemini-cli Action on repositories that accept pull requests from external contributors; they used --yolo mode for convenience without configuring allowlists; and they granted the CI service account broad secret access rather than isolating Gemini CLI to a dedicated job.

In practice, we see two common deployment mistakes. The first is enabling a new AI tool in CI and granting it the same GITHUB_TOKEN permissions as the rest of the pipeline, without considering that an AI agent that processes PR content is a fundamentally different trust boundary than a linter or test runner. The second is treating the initial patch as complete remediation while leaving the prompt injection attack surface unaddressed.

BeyondScale's AI security assessment includes review of CI/CD pipeline configurations for agentic AI tools including Gemini CLI, with specific testing for workspace trust bypass conditions and prompt injection vectors through GitHub event sources. If your organization has been running the run-gemini-cli Action on public-facing repositories, a targeted assessment can confirm whether your current configuration is defensible.

Conclusion

Gemini CLI enterprise security is not a single patching event. CVE-2026-12537 represents trust model failures in headless deployments. The "Comment and Control" attack class represents prompt injection through untrusted content that no current version of Gemini CLI is fully immune to by design. API key scope expansion represents silent credential upgrades when enabling GCP APIs. MCP integration represents command injection in the tooling layer.

Each of these requires a distinct control. Organizations that update Gemini CLI but leave workflows processing untrusted GitHub events without prompt injection mitigations remain exposed. Organizations that patch the CLI but do not audit API key scopes leave financial risk unaddressed.

Start with the patch and version pinning as the immediate action. Then work through API key governance, pipeline isolation, and monitoring as a second pass. If your team is running Gemini CLI in CI/CD and wants an independent review of your current configuration, contact BeyondScale or run a Securetom scan to identify exposed AI agent endpoints and prompt injection surfaces before attackers do.