What is GHSA-jj69-4grx-fqj5?

GHSA-jj69-4grx-fqj5 is a security advisory published by GitHub Security Advisories with Critical severity. Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI ...

Which CVE IDs does GHSA-jj69-4grx-fqj5 cover?

GHSA-jj69-4grx-fqj5 covers the following CVE IDs: CVE-2026-12537. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jj69-4grx-fqj5?

GHSA-jj69-4grx-fqj5 has a CVSS v3 base score of 7.8, published by GitHub Security Advisories.

GHSA-jj69-4grx-fqj5CriticalCVSS 7.8

Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI ...

Vendor

GitHub Security Advisories

Published

June 24, 2026

Last Modified

July 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-12537 →

📋 Description

Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously crafted .gemini/.env file.

🔗 References (3)

https://github.com/google-github-actions/run-gemini-cli/security/advisories/GHSA-wpqr-6v78-jr5g
https://nvd.nist.gov/vuln/detail/CVE-2026-12537
https://github.com/advisories/GHSA-jj69-4grx-fqj5