anonhaven

CVE-2026-13745

CRITICAL CVSS 4.0: 9.2 EPSS 0.30%
Updated Sep 10, 2026
Google Cloud
Parameter Value
CVSS 9.2 (CRITICAL)
Type CWE-20 (Improper Input Validation), CWE-78 (OS Command Injection)
Vendor Google Cloud
Public PoC No

A vulnerability in the Gemini CLI and associated GitHub Action allowed an unprivileged attacker to achieve an arbitrary code execution in Gemini CLI via untrusted local .env files overriding GEMINI_CLI_HOME.

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service

CVSS Vector v4.0

Weakness Type (CWE)

CWE-20 Improper Input Validation
CWE-78 OS Command Injection

Vulnerable Products

google cloud:gemini cli google cloud:run-gemini-cli github action

References 2

https://github.com/google-github-actions/run-gemini-cli/releases/tag/v0.1.22
NVD
https://github.com/google-github-actions/run-gemini-cli/security/advisories/GHS…
NVD
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-19410

Google Cloud

9.4

CVE-2026-12710

Google Cloud

9.3

CVE-2025-12742

Google Cloud

7.5

CVE-2025-12741

Google Cloud

7.7

CVE-2025-12740

Google Cloud

7.7