incidents.si
INC-2025-0010SEV3 · Medium (potential)prompt-injectionresearch-demo

Gemini CLI could be made to run hidden commands from a repository file

Tracebit showed that a prompt injection hidden in a repository’s README could make Gemini CLI run a command the user never saw. Google fixed it in version 0.1.14.

Disclosed
Published
Organization
Google
System
Gemini CLI
Impact
Demonstrated exfiltration of environment variables from a developer machine; no exploitation reported

Timeline

  • 2025-06-25. Gemini CLI is released.
  • 2025-06-27. Tracebit reports the issue to Google.
  • 2025-07-23. Google raises the priority of the report.
  • 2025-07-25. Version 0.1.14 is released with a fix.
  • 2025-07-28. Tracebit publishes its findings.

Trigger or entry point

A repository that the user asks Gemini CLI to inspect. Its README contains instructions for the model, placed inside license text.

Failure mechanism

Tracebit describes a combination of three problems. The injected text made the agent ask to run a harmless search command, which the user approved and added to the allow-list. The check that compared later commands against the allow-list was loose, so a longer command that began the same way ran without a new approval. Long whitespace kept the added part out of view in the terminal. The repository also contained an ordinary Python file, so nothing about it looked unusual.

Impact

The demonstration sent the machine’s environment variables, which may contain secrets, to a remote server. The severity is potential.

Response

Google fixed the issue in version 0.1.14. In a statement quoted by Tracebit, Google said that its security model for the tool centers on sandboxing. Tracebit’s timeline shows that the report was first triaged at a low priority and was reclassified to the highest priority and severity on 2025-07-23, two days before the fix.

Mitigations

In the fixed version the full command is shown and needs approval. Both sources advise running the tool in a sandbox and not on untrusted code.

Sources

  1. Code Execution Through Deception: Gemini AI CLI Hijackprimary · 2025-07-28
  2. Researchers flag flaw in Google’s AI coding assistant that allowed for ‘silent’ code exfiltrationsecondary · 2025-07-28

Corrections

No corrections have been made to this entry.

Report a correction