Vulnerabilities

Google Fixes CVSS 10 Gemini CLI CI RCE and Cursor Flaws Enable Code Execution

Maximum severity flaws in Google Gemini CLI and Cursor IDE enable remote code execution on developer workstations.

Summary written by editorial AI · Source link below

Filed by THN (Feedburner)30 April 20261 min readRead at source ↗

Google has addressed a maximum severity security flaw in Gemini CLI -- the "@google/gemini-cli" npm package and the "google-github-actions/run-gemini-cli" GitHub Actions workflow -- that could have allowed attackers to execute arbitrary commands on host systems. "The vulnerability allowed an unprivileged external attacker to force their own malicious content to load as Gemini configuration,"

Continue at the source

Read the full report at THN (Feedburner)

External link — opens at THN (Feedburner) in a new tab.

Continue with

More from the Vulnerabilities Desk