---
id: CVE-2026-0755
title: >-
  gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via
  prompt quoting (CVE-2026-0755)
summary: >-
  gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via
  prompt quoting (CVE-2026-0755)
severity: critical
cvss: 9.8
cwe:
  - CWE-78
vendor: gemini-mcp-tool
product: gemini-mcp-tool
affected:
  - 'gemini-mcp-tool >= 1.1.2, < 1.1.6'
patched:
  - gemini-mcp-tool 1.1.6
published: '2026-06-18'
updated: '2026-06-18'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-4h5r-5jm8-jxjm'
references:
  - url: >-
      https://github.com/jamubc/gemini-mcp-tool/security/advisories/GHSA-4h5r-5jm8-jxjm
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-0755'
  - url: 'https://www.zerodayinitiative.com/advisories/ZDI-26-021'
  - url: 'https://github.com/advisories/GHSA-4h5r-5jm8-jxjm'
tags:
  - ghsa
  - npm
epss: 0.03471
epssPercentile: 0.88611
ingestedAt: '2026-06-19T03:39:00.768Z'
ecosystem: npm
zeroDay: true
---

## Overview

Untrusted prompt input could reach the Gemini CLI @file parser, allowing read/exfiltration of arbitrary local files (@/etc/passwd, @~/.ssh/id_rsa, @../../secret). On Windows, unquoted cmd.exe metacharacters could break out into OS command injection.

Fix (1.1.6): removed the broken shell:false double-quote wrapping; added assertSafeFileReferences() to contain @file refs to the working directory; hardened Windows cmd.exe argument quoting.

## Affected packages

- `gemini-mcp-tool >= 1.1.2, < 1.1.6`

## Remediation

Upgrade to a patched release:

- `gemini-mcp-tool 1.1.6`