// GeminiCRITICAL
Google's run-gemini-cli GitHub Action contained a critical vulnerability (GHSA-wpqr-6v78-jr5g, CVSS 10.0) allowing arbitrary shell command execution in CI/CD workflows. Researchers demonstrated that misconfigured actions could execute attacker-injected commands with access to workflow secrets and repository credentials, enabling repository takeover and supply-chain tampering.
- Critical Flaws in Claude Code, Gemini CLI, and OpenAI Codex Enab(opens in a new tab)
- Critical Flaws in Claude Code, Gemini CLI, and OpenAI Codex Enab(opens in a new tab)
// Get alerts for Gemini