---
id: CVE-2026-12537
title: >-
  Improper Neutralization used in an OS Command in the container launcher in
  Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action
  (versions prior to 0.1.22) on headless CI platforms allows an unprivileged
  attacker …
summary: >-
  Improper Neutralization used in an OS Command in the container launcher in
  Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action
  (versions prior to 0.1.22) on headless CI platforms allows an unprivileged
  attacker …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-20
  - CWE-78
  - CWE-77
  - CWE-200
vendor: google
product: gemini-cli
affected:
  - gemini-cli < 0.39.1
  - gemini-cli = 0.40.0
  - run-gemini-cli < 0.1.22
patched:
  - gemini-cli 0.39.1
  - run-gemini-cli 0.1.22
published: '2026-06-24'
updated: '2026-07-02'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-12537'
references:
  - url: >-
      https://github.com/google-github-actions/run-gemini-cli/security/advisories/GHSA-wpqr-6v78-jr5g
    label: f45cbf4e-4146-4068-b7e1-655ffc2c548c
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-12537'
  - url: 'https://github.com/advisories/GHSA-wpqr-6v78-jr5g'
tags:
  - nvd
  - ghsa
  - npm
  - score-dispute
epss: 0.00212
epssPercentile: 0.10234
ingestedAt: '2026-07-03T13:02:27.981Z'
aliases:
  - GHSA-wpqr-6v78-jr5g
ecosystem: npm
scores:
  nvd: 7.8
  ghsa: 10
---

## Overview

Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously crafted .gemini/.env file.

## Affected

- `gemini-cli < 0.39.1`
- `gemini-cli = 0.40.0`
- `run-gemini-cli < 0.1.22`

## Remediation

Upgrade past the affected range:

- `gemini-cli 0.39.1`
- `run-gemini-cli 0.1.22`

## Package advisory (CVE-2026-12537)

Affected packages:

- `@google/gemini-cli < 0.39.1`
- `@google/gemini-cli = 0.40.0-preview.2`
- `google-github-actions/run-gemini-cli < 0.1.22`

Patched in:

- `@google/gemini-cli 0.39.1`
- `@google/gemini-cli 0.40.0-preview.3`
- `google-github-actions/run-gemini-cli 0.1.22`

Source: https://github.com/advisories/GHSA-wpqr-6v78-jr5g