{"vulnerability": "CVE-2026-12537", "sightings": [{"uuid": "d57b6925-3946-46e5-a71f-d81c72af4c5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12537", "type": "seen", "source": "https://t.me/pphm_HackerNews/2512", "content": "\ud83d\udd34 Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets\n\nA GitHub issue opened by an account with no repository privileges was enough to execute code on the CI runners behind Anthropic's and Google's own coding-agent repositories. On OpenAI's, it was enough to hijack the next agent run.\n\nNovee Security ran the attack against each vendor's agent in the configuration that the vendor ships by default, and presented the work at Black Hat USA on August 5. Two CVEs came out of it. Both are patched.\n\nGemini CLI carries the worst of the two. CVE-2026-12537 (CVSS 4 score: 10.0) is an OS command injection in the container launcher, reached through a crafted .gemini/.env file, which lets an unprivileged attacker run code on the host of a headless CI platform before the sandbox starts. It is fixed in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22.", "creation_timestamp": "2026-08-21T23:00:07.017866Z"}, {"uuid": "696b2532-53cd-4736-b0fd-ae42e98c7dc4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12537", "type": "seen", "source": "https://gist.github.com/dev-krish-xyz/7604ca4e2ca8081e4e1481b4aa8e3585", "content": "\n| Product | Identifier | What Disagreed | Fixed In |\n|---|---|---|---|\n| claude-code-action | *None located* | Validator stripped single-quoted spans;git read them as a program path | Explicit git-push allowlist;most Bash tools removed |\n| claude-code | *None located* | Literal `/proc/self/environ` guardvs. the shell's quote removal | Step Summary output sanitized |\n| claude-code | CVE-2026-54316 | `huggingface.co` approved as a barehostname vs. every path under it | 2.1.163 |\n| Gemini CLI | CVE-2026-12537GHSA-wpqr-6v78-jr5g | `startsWith(\"run_shell_command(\")` vs. restriction inside parens;sanitized child env vs. shared PID namespace | 0.39.1run-gemini-cli 0.1.22 |\n| codex-action | None assigned | The prompt as the instruction channelvs. a writable `AGENTS.md` | Separate jobs, independent checkouts;`AGENTS.md` read-only |\n| claude-code-action | \u2014 | `endsWith(\"[bot]\")` vs. an actualpermission check | v1.0.94 |\n", "creation_timestamp": "2026-08-08T11:50:10.167500Z"}, {"uuid": "ef947b1d-860e-4fa0-abc5-9d9ceccc097d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12537", "type": "seen", "source": "https://gist.github.com/dev-krish-xyz/5f4be84470b9a2c442b412e32e70e294", "content": "\n| Product | Reported By | Identifier | What Disagreed | Fixed In |\n|---|---|---|---|---|\n| claude-code-action | Novee | *Nonelocated* | Validator stripped single-quoted spans;git read them as a program path | Explicit git-push allowlist;most Bash tools removed |\n| claude-code | Novee | *Nonelocated* | Literal `/proc/self/environ` guardvs. the shell's quote removal | Step Summary output sanitized |\n| claude-code | Novee | CVE-2026-54316 | `huggingface.co` approved as a barehostname vs. every path under it | 2.1.163 |\n| Gemini CLI | Novee | CVE-2026-12537GHSA-wpqr-6v78-jr5g | `startsWith(\"run_shell_command(\")` vs. restriction inside parens;sanitized child env vs. shared PID namespace | 0.39.1run-gemini-cli 0.1.22 |\n| codex-action | Novee | Noneassigned | The prompt as the instruction channelvs. a writable `AGENTS.md` | Separate jobs, independent checkouts;`AGENTS.md` read-only |\n| claude-code-action | GMO Flatt(RyotaK) | \u2014 | `endsWith(\"[bot]\")` vs. an actualpermission check | v1.0.94 |\n", "creation_timestamp": "2026-08-08T12:06:34.341717Z"}, {"uuid": "67dfe455-f005-46ba-9973-b07f0763cfc1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12537", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp2ie25yct2k", "content": "CVE-2026-12537 - Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows\nCVE ID : CVE-2026-12537\n \n Published : June 24, 2026, 1:37 p.m. | 3\u00a0hours, 33\u00a0minutes ago\n \n Description : Improper Neutralization used in an OS Command in the container launcher in Google Gem...", "creation_timestamp": "2026-06-24T17:55:17.558979Z"}, {"uuid": "21eca65d-fc0d-45a7-a735-2486bbb15e73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12537", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mpfd3vdhxd2f", "content": "Gemini CLI Vulnerability Hits Maximum CVSS 10\u00a0Score\n\nA critical Gemini CLI vulnerability (CVE-2026-12537) exposes developer workflows to maximum severity attacks. Google disclosed this CVSS 10 rating flaw recently. TL;DR A critical Gemini CLI vulnerability allows OS command injection in continuous\u2026", "creation_timestamp": "2026-06-29T01:20:33.393042Z"}, {"uuid": "ff842de6-5bfb-425e-9447-5516cb9b3c8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12537", "type": "seen", "source": "https://t.me/pphm_HackerNews/2512", "content": "\ud83d\udd34 Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets\n\nA GitHub issue opened by an account with no repository privileges was enough to execute code on the CI runners behind Anthropic's and Google's own coding-agent repositories. On OpenAI's, it was enough to hijack the next agent run.\n\nNovee Security ran the attack against each vendor's agent in the configuration that the vendor ships by default, and presented the work at Black Hat USA on August 5. Two CVEs came out of it. Both are patched.\n\nGemini CLI carries the worst of the two. CVE-2026-12537 (CVSS 4 score: 10.0) is an OS command injection in the container launcher, reached through a crafted .gemini/.env file, which lets an unprivileged attacker run code on the host of a headless CI platform before the sandbox starts. It is fixed in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22.", "creation_timestamp": "2026-08-22T00:00:10.644495Z"}, {"uuid": "d13a9d52-3199-474a-9013-c140b46fac8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12537", "type": "seen", "source": "https://t.me/pphm_HackerNews/2512", "content": "\ud83d\udd34 Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets\n\nA GitHub issue opened by an account with no repository privileges was enough to execute code on the CI runners behind Anthropic's and Google's own coding-agent repositories. On OpenAI's, it was enough to hijack the next agent run.\n\nNovee Security ran the attack against each vendor's agent in the configuration that the vendor ships by default, and presented the work at Black Hat USA on August 5. Two CVEs came out of it. Both are patched.\n\nGemini CLI carries the worst of the two. CVE-2026-12537 (CVSS 4 score: 10.0) is an OS command injection in the container launcher, reached through a crafted .gemini/.env file, which lets an unprivileged attacker run code on the host of a headless CI platform before the sandbox starts. It is fixed in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22.", "creation_timestamp": "2026-08-23T00:00:46.111721Z"}]}