Gemini CLI and Claude Code Flaws Expose CI Secrets

What to do

1. Update run-gemini-cli to 0.1.22+ and Gemini CLI to 0.39.1+; check pinned versions in .github/workflows
2. Update Claude Code to 2.1.163 or later (claude --version; npm i -g @anthropic-ai/claude-code@latest)
3. For untrusted triggers (issues, fork PRs, comments), follow the hardening guide and do not set GEMINI_TRUST_WORKSPACE=true
4. Give agent jobs read-only GITHUB_TOKEN permissions and no deploy or cloud secrets; avoid --yolo or auto-approve modes on untrusted input
5. Rotate tokens and secrets exposed to agent jobs that processed outsider content on vulnerable versions

How to check if you are affected or compromised

• grep -rn 'run-gemini-cli\|gemini-cli\|claude-code' .github/workflows to list agent jobs and their pinned versions
• Review Actions logs for agent runs on issues/PRs from unknown accounts and for unexpected shell commands or outbound requests
• Check for WebFetch calls to huggingface.co paths you do not recognize in Claude Code transcripts or logs

What happened#

At Black Hat USA on August 5, 2026, Novee Security presented research showing how an outsider can reach CI secrets or the CI host itself through AI coding agents. The attacker needs nothing more than a GitHub issue opened by an account with no repository privileges, as reported by The Hacker News. Two of the findings carry CVEs and vendor advisories.

Gemini CLI, CVE-2026-12537. Google's GHSA-wpqr-6v78-jr5g (April 24, 2026; CVSS 10.0) fixed two problems:

• In headless and CI mode, Gemini CLI automatically trusted the workspace folder. That let a malicious .gemini/.env in the checked-out content run commands on the host before the sandbox started.
• Under --yolo, the tool allowlist in settings.json was ignored. A prompt-injected issue could therefore make the agent run shell commands and steal GITHUB_TOKEN.

The CVE record, issued by Google Cloud as CNA, scores it CVSS 4.0 10.0. Google says all Gemini CLI GitHub Actions are affected.

Claude Code, CVE-2026-54316. Anthropic's GHSA-fg94-h982-f3mm explains that huggingface.co was pre-approved as a bare hostname for the WebFetch tool. As a result, any path on the domain, including attacker-owned model repositories, was fetched without a prompt and ignored --allowedTools. Hugging Face counts those fetches as downloads, so an attacker could read secrets encoded in request paths through the download counter of a repository they control.

Anthropic rates the flaw Moderate (CVSS 4.0 6.0) because the attacker must first get untrusted content into Claude Code's context. The Hacker News notes that NVD scored it 9.1 under CVSS 3.1, so the two scores are not directly comparable.

Who is affected#

• @google/gemini-cli before 0.39.1 (and before 0.40.0-preview.3), and google-github-actions/run-gemini-cli before 0.1.22.
• @anthropic-ai/claude-code from 0.2.54 up to (not including) 2.1.163, per the CVE record. Anthropic says users on standard auto-update already have the fix.

Novee also reported a Claude Code command-validator bypass and an OpenAI Codex workflow issue. Neither has a CVE. OpenAI responded by tightening its codex-action guidance.

Do you really need to act?#

For most developers using these tools interactively on a laptop, no: auto-update has already handled it. The real exposure is CI.

The setup to look for is a workflow that does all of the following:

• triggers on issues, comments or fork PRs
• runs a pinned, older agent version
• has write-scoped tokens or deploy secrets in the job environment

In that setup, the Gemini CLI bug is close to the worst case: no privileges, no click, and code execution on the runner. The Claude Code bug is narrower, a covert data leak that depends on prompt injection, but it fits the same untrusted-issue pattern.

Per The Hacker News, CISA records no exploitation for either CVE, and neither is in KEV. A public reproduction lab for the Claude Code flaw has existed since June. Researchers also note residual risk: if a workflow allowlists cat, an agent can still read /proc and .git/config.

A related September disclosure, Plugin4Shell, showed that pinned agent plugins can be swapped through hash-named branches. Help Net Security reports it is fixed in Claude Code 2.1.179 and Codex 0.146.0, still unpatched in GitHub Copilot, and will not be fixed in the deprecated Gemini CLI. It has no CVE yet.

What to do now#

1. Run grep -rn "gemini-cli\|claude-code" .github/workflows and bump run-gemini-cli to 0.1.22+ and Gemini CLI to 0.39.1+.
2. Run claude --version and update to 2.1.163 or later; for Plugin4Shell, use 2.1.179 or later.
3. For untrusted triggers, follow Google's hardening guidance. Only set GEMINI_TRUST_WORKSPACE: 'true' for trusted inputs.
4. Set permissions: contents: read on agent jobs. Keep deploy and cloud secrets out of them, and avoid --yolo or auto-approve modes on outsider content.
5. Rotate secrets that were exposed to agent jobs which processed outsider content on vulnerable versions.

How to tell if you were hit#

Review Actions run logs for agent jobs triggered by unknown accounts, unexpected shell commands, or reads of .env and credential files. In Claude Code logs or transcripts, look for WebFetch requests to unfamiliar huggingface.co/.../resolve/ paths. In the repository audit log, check for pushes or token use that no maintainer initiated.

Timeline#

• Apr 24, 2026: Google publishes GHSA-wpqr-6v78-jr5g; Gemini CLI 0.39.1 and run-gemini-cli 0.1.22 released.
• Jun 13, 2026: Anthropic publishes GHSA-fg94-h982-f3mm; fixed in Claude Code 2.1.163.
• Jun 23, 2026: CVE-2026-54316 published.
• Jun 24, 2026: CVE-2026-12537 published.
• Aug 5, 2026: Novee presents the CI attack chains at Black Hat USA.
• Sep 18, 2026: Plugin4Shell disclosed.

Vulnerability records

• CVE-2026-12537 · Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action…
• CVE-2026-54316 · Claude Code is an agentic coding tool. From 0.2.54 until 2.1.163, because the hostname huggingface.co was pre-approved as a bare hostname for the WebFetch…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Google (GitHub) — GHSA-wpqr-6v78-jr5g: Update to Gemini CLI and run-gemini-cli trust model github.com
2. Anthropic (GitHub) — GHSA-fg94-h982-f3mm: Out-of-band data exfiltration via pre-approved HuggingFace domain in WebFetch github.com
3. CVE.org — CVE-2026-12537 record cve.org
4. CVE.org — CVE-2026-54316 record cve.org

Coverage and analysis

1. The Hacker News — Claude Code and Gemini CLI flaws let a GitHub issue reach CI workflow secrets thehackernews.com
2. The Hacker News — Google fixes CVSS 10 Gemini CLI CI RCE; Cursor flaws enable code execution thehackernews.com
3. Help Net Security — Plugin4Shell: zero-click RCE hit four major AI coding agents helpnetsecurity.com