---
title: "Gemini CLI and Claude Code Flaws Expose CI Secrets"
url: https://erroneo.us/security/briefs/gemini-cli-claude-code-ci-agent-flaws/
description: "CVE-2026-12537 (Gemini CLI, CVSS 10) and CVE-2026-54316 (Claude Code) let a GitHub issue reach CI hosts or secrets. Update pinned Actions and CLIs."
type: security-brief
section: "Security Digest"
date_published: 2026-08-05
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-12537", "CVE-2026-54316"]
severity: "critical"
exploited: "public-poc"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# Gemini CLI and Claude Code Flaws Expose CI Secrets

**Verdict: Check exposure.** If an AI coding agent runs in your CI on content outsiders can write (issues, PRs, comments), check versions and workflow permissions this week; laptop users on auto-update already have the fixes.

- **Who must act:** Teams running Gemini CLI or Claude Code in GitHub Actions or other CI on untrusted input, especially with pinned old versions, --yolo, or write-scoped tokens.
- **Who can relax:** Individual developers on auto-updating installs who do not feed untrusted repos or issues to the agent, and teams that run no AI agent in CI.
- **Affected:** @google/gemini-cli < 0.39.1 (and < 0.40.0-preview.3); google-github-actions/run-gemini-cli < 0.1.22; @anthropic-ai/claude-code >= 0.2.54, < 2.1.163
- **Fixed:** @google/gemini-cli 0.39.1 / 0.40.0-preview.3; run-gemini-cli 0.1.22; @anthropic-ai/claude-code 2.1.163
- **CVEs:** CVE-2026-12537, CVE-2026-54316
- **CISA KEV:** no · **Exploitation:** Public proof-of-concept

## What to do

1. Update run-gemini-cli to 0.1.22+ and Gemini CLI to 0.39.1+; check pinned versions in .github/workflows
2. Update Claude Code to 2.1.163 or later (claude --version; npm i -g @anthropic-ai/claude-code@latest)
3. For untrusted triggers (issues, fork PRs, comments), follow the hardening guide and do not set GEMINI_TRUST_WORKSPACE=true
4. Give agent jobs read-only GITHUB_TOKEN permissions and no deploy or cloud secrets; avoid --yolo or auto-approve modes on untrusted input
5. Rotate tokens and secrets exposed to agent jobs that processed outsider content on vulnerable versions

### How to check if you are affected

- grep -rn 'run-gemini-cli\|gemini-cli\|claude-code' .github/workflows to list agent jobs and their pinned versions
- Review Actions logs for agent runs on issues/PRs from unknown accounts and for unexpected shell commands or outbound requests
- Check for WebFetch calls to huggingface.co paths you do not recognize in Claude Code transcripts or logs

## What happened

At Black Hat USA on August 5, 2026, Novee Security presented research showing how an outsider can reach CI secrets or the CI host itself through AI coding agents. The attacker needs nothing more than a GitHub issue opened by an account with no repository privileges, [as reported by The Hacker News](https://thehackernews.com/2026/08/claude-code-and-gemini-cli-flaws-let.html). Two of the findings carry CVEs and vendor advisories.

**Gemini CLI, CVE-2026-12537.** Google's [GHSA-wpqr-6v78-jr5g](https://github.com/google-github-actions/run-gemini-cli/security/advisories/GHSA-wpqr-6v78-jr5g) (April 24, 2026; CVSS 10.0) fixed two problems:

- In headless and CI mode, Gemini CLI automatically trusted the workspace folder. That let a malicious `.gemini/.env` in the checked-out content run commands on the host before the sandbox started.
- Under `--yolo`, the tool allowlist in `settings.json` was ignored. A prompt-injected issue could therefore make the agent run shell commands and steal `GITHUB_TOKEN`.

The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-12537), issued by Google Cloud as CNA, scores it CVSS 4.0 10.0. Google says all Gemini CLI GitHub Actions are affected.

**Claude Code, CVE-2026-54316.** Anthropic's [GHSA-fg94-h982-f3mm](https://github.com/anthropics/claude-code/security/advisories/GHSA-fg94-h982-f3mm) explains that `huggingface.co` was pre-approved as a bare hostname for the WebFetch tool. As a result, any path on the domain, including attacker-owned model repositories, was fetched without a prompt and ignored `--allowedTools`. Hugging Face counts those fetches as downloads, so an attacker could read secrets encoded in request paths through the download counter of a repository they control.

Anthropic rates the flaw Moderate (CVSS 4.0 6.0) because the attacker must first get untrusted content into Claude Code's context. The Hacker News notes that NVD scored it 9.1 under CVSS 3.1, so the two scores are not directly comparable.

## Who is affected

- `@google/gemini-cli` before 0.39.1 (and before 0.40.0-preview.3), and `google-github-actions/run-gemini-cli` before 0.1.22.
- `@anthropic-ai/claude-code` from 0.2.54 up to (not including) 2.1.163, per the [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-54316). Anthropic says users on standard auto-update already have the fix.

Novee also reported a Claude Code command-validator bypass and an OpenAI Codex workflow issue. Neither has a CVE. OpenAI responded by tightening its codex-action guidance.

## Do you really need to act?

For most developers using these tools interactively on a laptop, no: auto-update has already handled it. The real exposure is CI.

The setup to look for is a workflow that does all of the following:

- triggers on issues, comments or fork PRs
- runs a pinned, older agent version
- has write-scoped tokens or deploy secrets in the job environment

In that setup, the Gemini CLI bug is close to the worst case: no privileges, no click, and code execution on the runner. The Claude Code bug is narrower, a covert data leak that depends on prompt injection, but it fits the same untrusted-issue pattern.

Per The Hacker News, CISA records no exploitation for either CVE, and neither is in KEV. A public reproduction lab for the Claude Code flaw has existed since June. [Researchers also note](https://thehackernews.com/2026/04/google-fixes-cvss-10-gemini-cli-ci-rce.html) residual risk: if a workflow allowlists `cat`, an agent can still read `/proc` and `.git/config`.

A related September disclosure, [Plugin4Shell](https://www.helpnetsecurity.com/2026/09/18/plugin4shell-ai-coding-agents-vulnerability/), showed that pinned agent plugins can be swapped through hash-named branches. Help Net Security reports it is fixed in Claude Code 2.1.179 and Codex 0.146.0, still unpatched in GitHub Copilot, and will not be fixed in the deprecated Gemini CLI. It has no CVE yet.

## What to do now

1. Run `grep -rn "gemini-cli\|claude-code" .github/workflows` and bump `run-gemini-cli` to 0.1.22+ and Gemini CLI to 0.39.1+.
2. Run `claude --version` and update to 2.1.163 or later; for Plugin4Shell, use 2.1.179 or later.
3. For untrusted triggers, follow Google's hardening guidance. Only set `GEMINI_TRUST_WORKSPACE: 'true'` for trusted inputs.
4. Set `permissions: contents: read` on agent jobs. Keep deploy and cloud secrets out of them, and avoid `--yolo` or auto-approve modes on outsider content.
5. Rotate secrets that were exposed to agent jobs which processed outsider content on vulnerable versions.

## How to tell if you were hit

Review Actions run logs for agent jobs triggered by unknown accounts, unexpected shell commands, or reads of `.env` and credential files. In Claude Code logs or transcripts, look for WebFetch requests to unfamiliar `huggingface.co/.../resolve/` paths. In the repository audit log, check for pushes or token use that no maintainer initiated.

## Timeline

- Apr 24, 2026: Google publishes GHSA-wpqr-6v78-jr5g; Gemini CLI 0.39.1 and run-gemini-cli 0.1.22 released.
- Jun 13, 2026: Anthropic publishes GHSA-fg94-h982-f3mm; fixed in Claude Code 2.1.163.
- Jun 23, 2026: CVE-2026-54316 published.
- Jun 24, 2026: CVE-2026-12537 published.
- Aug 5, 2026: Novee presents the CI attack chains at Black Hat USA.
- Sep 18, 2026: Plugin4Shell disclosed.

## Sources

1. [Google (GitHub) — GHSA-wpqr-6v78-jr5g: Update to Gemini CLI and run-gemini-cli trust model](https://github.com/google-github-actions/run-gemini-cli/security/advisories/GHSA-wpqr-6v78-jr5g)
2. [Anthropic (GitHub) — GHSA-fg94-h982-f3mm: Out-of-band data exfiltration via pre-approved HuggingFace domain in WebFetch](https://github.com/anthropics/claude-code/security/advisories/GHSA-fg94-h982-f3mm)
3. [CVE.org — CVE-2026-12537 record](https://www.cve.org/CVERecord?id=CVE-2026-12537)
4. [CVE.org — CVE-2026-54316 record](https://www.cve.org/CVERecord?id=CVE-2026-54316)
5. [The Hacker News — Claude Code and Gemini CLI flaws let a GitHub issue reach CI workflow secrets](https://thehackernews.com/2026/08/claude-code-and-gemini-cli-flaws-let.html)
6. [The Hacker News — Google fixes CVSS 10 Gemini CLI CI RCE; Cursor flaws enable code execution](https://thehackernews.com/2026/04/google-fixes-cvss-10-gemini-cli-ci-rce.html)
7. [Help Net Security — Plugin4Shell: zero-click RCE hit four major AI coding agents](https://www.helpnetsecurity.com/2026/09/18/plugin4shell-ai-coding-agents-vulnerability/)

---
Source page: https://erroneo.us/security/briefs/gemini-cli-claude-code-ci-agent-flaws/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt