Google Cloud run-gemini-cli GitHub Action vulnerabilities

Latest Google Cloud run-gemini-cli GitHub Action CVEs

Newest publication first

1. CVE-2026-12537 Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows

   Published 2026-06-24

   Critical·CVSS 10.0

   Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code exec...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.