Notifications
Clear all
Topic starter
02/08/2026 11:41 am
TL;DR: A CVSS 10.0 remote code execution flaw in Google Gemini CLI let external attackers trigger host-level commands through trusted workspace content in headless CI/CD runs, turning AI-assisted pipelines into supply-chain attack paths, according to Novee. The issue shows that agentic security failures now often sit at the boundary between configuration trust, execution privileges, and pipeline governance.
NHIMG editorial — based on content published by Novee: A CVSS 10.0 in Gemini CLI: How Agentic Workflows Are Reshaping Supply Chain Risk
By the numbers:
- A CVSS 10.0 RCE vulnerability in Google Gemini CLI allowed external attackers to execute commands on host systems, turning CI/CD pipelines into supply-chain attack paths.
- Patches are available in @google/gemini-cli 0.39.1 and 0.40.0-preview.3, and google-github-actions/run-gemini-cli 0.1.22.
Questions worth separating out
Q: What breaks when AI agents are allowed to act inside privileged CI/CD workflows?
A: What breaks is the assumption that repository inputs are still untrusted once a workflow starts running.
Q: Why do AI chat tools create risk for identity and access teams?
A: They create risk because users may rely on plausible but unverified output when making identity, access, or security decisions.
Q: How do security teams know if an agentic pipeline is actually safe?
A: Look for evidence that untrusted input cannot reach execution without explicit validation.
Practitioner guidance
- Restrict workspace trust at the runner boundary Disable automatic trust for repository content in headless agent runs and require explicit validation before configuration is loaded from a workspace.
- Isolate agent runners from reusable credentials Run AI-assisted CI jobs in tightly scoped environments with short-lived tokens, no standing cloud access, and no access to secrets that are not needed for the specific task.
- Map agent privileges as non-human identities Inventory AI coding agents, GitHub Actions, and other automation that can read workspaces or invoke shells, then document the exact identities, secrets, and deployment permissions each one inherits.
What's in the full analysis
Novee's full article covers the operational detail this post intentionally leaves for the source:
- Version-specific patch guidance for affected Gemini CLI and GitHub Action releases.
- The exact trust-path weakness that let workspace content become configuration in headless runs.
- The broader supply-chain attack patterns the research team used to contextualise the flaw.
- Why continuous adversarial validation is being positioned as a way to test live pipelines.
👉 Read Novee's analysis of the Gemini CLI CVSS 10.0 supply-chain RCE →
Gemini CLI RCE and CI/CD trust: what security teams need to know?
Explore further
02/08/2026 12:53 pm
Agentic pipeline trust is becoming a governance problem, not just a tooling problem. The vulnerability shows that a non-human identity can inherit more practical power from its runtime context than from any formal policy on paper. In CI/CD, the relevant control question is not whether the agent is allowed to act in general, but whether untrusted workspace content can become executable before the system validates it. That is a classic identity-and-execution boundary failure, and it belongs in PAM, NHI, and pipeline governance reviews.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to The State of Secrets Sprawl 2026.
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to The State of Secrets Sprawl 2026.
A question worth separating out:
Q: Who is accountable when an AI workflow executes attacker-controlled content on a host system?
A: Accountability sits with the teams that own the pipeline, the runner, and the secrets it can reach. This is a governance failure, not just a vulnerability disclosure. The relevant frameworks are NIST-CSF, NIST-800-53, and identity controls that define who or what can authorise execution.
👉 Read our full editorial: Gemini CLI RCE shows how agentic workflows expand supply-chain risk
