CVE-2026-13745
CVE-2026-13745 is a critical vulnerability (CVSS 9.2) in the Gemini CLI and its GitHub Action that enables unprivileged arbitrary code execution through untrusted local .env files which can override the GEMINI_CLI_HOME environment variable.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
None listed (affected products not specified)
Real-world impact
An attacker could gain full control of the system by executing arbitrary code via malicious .env files that manipulate the GEMINI_CLI_HOME setting, potentially compromising the entire environment and data.
Why this severity
The vulnerability is rated critical due to its ability to achieve arbitrary code execution without requiring elevated privileges, making it highly dangerous if exploited.
What to do about it
- ›Verify and restrict all .env files used by Gemini CLI to trusted, approved sources only.
- ›Validate and sanitize any environment variables before processing them in the CLI.
- ›Limit access to Gemini CLI to authorized personnel only.
- ›Monitor for unexpected changes to GEMINI_CLI_HOME or other configuration environment variables.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
Information sourced from the NVD description and CVE-2026-13745 metadata provided.