← All incidents

CVE-2026-13745: a project .env could point Gemini CLI at attacker config and run commands

Vulnerability · Gemini CLI · HIGH

Summary

Redguard showed that Gemini CLI before 0.39.1 loaded a workspace .env file and honored GEMINI_CLI_HOME from it. That let a malicious repository redirect the CLI's config folder into the project, ship a settings.json that turned off folder trust and registered a malicious MCP server, and run commands as soon as the victim started the CLI in that folder. No trust-dialog click was needed. Google fixed it in @google/gemini-cli 0.39.1 on Apr 24, 2026. Google first declined a CVE, then reserved CVE-2026-13745 after a MITRE dispute and published it on Sep 10, 2026 (GitHub advisory GHSA-2255-3477-vp73). Redguard rates it CVSS 4.0 7.7 High. This is a backfill of a fixed issue.

Severity

Timeline

1. Mar 4, 2026
   Redguard identifies the issue (per its disclosure timeline).
2. Mar 5, 2026
   Reported through Google Bughunters.
3. Mar 20, 2026
   Google accepts the vulnerability.
4. Apr 16 to May 5, 2026
   Google declines a CVE, saying it does not meet its publication criteria; Redguard asks for reconsideration and is declined again.
5. Apr 24, 2026
   @google/gemini-cli 0.39.1 is published on npm (fix).
6. May 11 to Jun 12, 2026
   Redguard opens a MITRE CVE dispute; Google later confirms a CVE will be issued.
7. Jun 3, 2026
   Redguard publishes its advisory and pwned.info write-up.
8. Jun 29, 2026
   Google reserves CVE-2026-13745.
9. Sep 10, 2026
   Google publishes CVE-2026-13745 and GitHub advisory GHSA-2255-3477-vp73. Redguard notes the first CVE text mixed in unrelated issues and a critical rating.
10. Sep 23, 2026
    Google adjusts the CVE record after Redguard's correction request.

How it happened

Gemini CLI loads environment variables from a project .env when it starts. Setting GEMINI_CLI_HOME there moves the trusted config root into the repository. An attacker can then place .gemini/settings.json under that path with folder trust disabled and an MCP server whose command is attacker-chosen. Because the config is treated as the user's own, the MCP server starts without the folder-trust prompt. The fix in 0.39.1 stops that .env override path from controlling trusted config. GitHub advisory GHSA-2255-3477-vp73 lists CWE-15 and CWE-20. A related GitHub advisory (GHSA-wpqr-6v78-jr5g) covers broader workspace-trust and tool-allowlist hardening in the same 0.39.1 line and in the google-github-actions/run-gemini-cli Action; this entry is about the .env GEMINI_CLI_HOME path described by Redguard and CVE-2026-13745.

How to check your app

• Update @google/gemini-cli to 0.39.1 or later (current latest on npm is well past that).
• Do not start Gemini CLI in a freshly cloned repository before you have looked at its .env and .gemini folders.
• If you use google-github-actions/run-gemini-cli in CI, use 0.1.22 or later.

Sources

• Redguard: Arbitrary Code Execution in Google's Gemini CLI
• pwned.info: Homing in on Arbitrary Code Execution within Gemini CLI
• GitHub advisory GHSA-2255-3477-vp73 (CVE-2026-13745)
• NVD: CVE-2026-13745
• Gemini CLI v0.39.1 release
• npm registry metadata for @google/gemini-cli

Corrections and updates

None. Re-checked against every source on Oct 15, 2026.