{"id":"CVE-2026-0755","title":"gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)","summary":"gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)","severity":"critical","cvss":9.8,"cwe":["CWE-78"],"vendor":"gemini-mcp-tool","product":"gemini-mcp-tool","affected":["gemini-mcp-tool >= 1.1.2, < 1.1.6"],"patched":["gemini-mcp-tool 1.1.6"],"published":"2026-06-18","updated":"2026-06-18","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-4h5r-5jm8-jxjm","references":[{"url":"https://github.com/jamubc/gemini-mcp-tool/security/advisories/GHSA-4h5r-5jm8-jxjm"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0755"},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-021"},{"url":"https://github.com/advisories/GHSA-4h5r-5jm8-jxjm"}],"tags":["ghsa","npm"],"epss":0.03471,"epssPercentile":0.88555,"ingestedAt":"2026-06-19T03:39:00.768Z","ecosystem":"npm","zeroDay":true,"slug":"CVE-2026-0755","body":"## Overview\n\nUntrusted prompt input could reach the Gemini CLI @file parser, allowing read/exfiltration of arbitrary local files (@/etc/passwd, @~/.ssh/id_rsa, @../../secret). On Windows, unquoted cmd.exe metacharacters could break out into OS command injection.\n\nFix (1.1.6): removed the broken shell:false double-quote wrapping; added assertSafeFileReferences() to contain @file refs to the working directory; hardened Windows cmd.exe argument quoting.\n\n## Affected packages\n\n- `gemini-mcp-tool >= 1.1.2, < 1.1.6`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `gemini-mcp-tool 1.1.6`","depth":"hadal","depthScore":80,"depthScoreParts":{"impact":53.9,"likelihood":0.7,"exploitation":25,"ransomware":0},"changes":[]}