// GeminiCRITICAL
Plugin4Shell, a zero-click remote code execution vulnerability, affects Gemini CLI by bypassing SHA pinning on plugin marketplace installations. The flaw allows attackers to inject malicious code into trusted plugins with no user action required, especially during background auto-updates. Google deprecated Gemini CLI rather than patching, leaving all existing installations indefinitely exposed to supply-chain attacks.
- Zero-click RCE vulnerability hit four major AI coding agents, tw(opens in a new tab)
- Plugin4Shell Zero-Click RCE Hits Claude Code, Codex, Copilot and(opens in a new tab)
- Plugin4Shell SHA-Pinning Bypass Hits 4 AI Coding Agents(opens in a new tab)
// Get alerts for Gemini