erroneo.us
Search all guides⌘K

Digest · Wednesday

Security digest: August 5, 2026

1 editorial brief, 1 known exploited (cisa kev) addition and 1 critical advisory.

All digests · RSS · Markdown

Take stock

  • Check exposure: Gemini CLI and Claude Code Flaws Expose CI Secrets. Teams running Gemini CLI or Claude Code in GitHub Actions or other CI on untrusted input, especially with pinned old versions, --yolo, or write-scoped tokens.
  • Do you run any of these? JetBrains TeamCity. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-08-08.
  • npm: 1 critical advisory (@nuxt/devtools). Check with npm audit (or: npm ls <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· AI agent security · CVE-2026-12537, CVE-2026-54316

Gemini CLI and Claude Code Flaws Expose CI Secrets

If an AI coding agent runs in your CI on content outsiders can write (issues, PRs, comments), check versions and workflow permissions this week; laptop users on auto-update already have the fixes.

Must act: Teams running Gemini CLI or Claude Code in GitHub Actions or other CI on untrusted input, especially with pinned old versions, --yolo, or write-scoped tokens.

Can relax: Individual developers on auto-updating installs who do not feed untrusted repos or issues to the agent, and teams that run no AI agent in CI.

  1. Update run-gemini-cli to 0.1.22+ and Gemini CLI to 0.39.1+; check pinned versions in .github/workflows
  2. Update Claude Code to 2.1.163 or later (claude --version; npm i -g @anthropic-ai/claude-code@latest)
  3. For untrusted triggers (issues, fork PRs, comments), follow the hardening guide and do not set GEMINI_TRUST_WORKSPACE=true

Read the brief →

Known exploited (CISA KEV) 1

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2026-63077JetBrains TeamCity
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability Ransomware		2026-08-08

Critical advisories by ecosystem 1

GitHub-reviewed advisories rated critical, published this day (Pacific time).

npm 1

Check: npm audit (or: npm ls <package>)