Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets
- ID
- 11882
- Status
- summarized
- Published
- 07 Aug 2026, 4:18 PM
- Fetched
- 07 Aug 2026, 5:39 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/claude-code-and-gemini-cli-flaws-let.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 8.5
- Created
- 07 Aug 2026, 5:40 PM
- Tags
- Audience
- developersvibe_codersai_agent_users
What happened
Novee Security demonstrated at Black Hat USA that a GitHub issue from an unprivileged account could execute code on CI runners behind Anthropic's, Google's, and OpenAI's own coding-agent repos. Gemini CLI's CVE-2026-12537 (CVSS 10.0) allows OS command injection via a crafted .gemini/.env file before the sandbox starts, fixed in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22. Claude Code's CVE-2026-54316 used Hugging Face's public download counter as an API key exfiltration channel, fixed in 2.1.163 (all versions from 0.2.54 affected); OpenAI's Codex got no CVE, with OpenAI stating its sandbox behaved as documented.
Why it matters
If you run Claude Code or Gemini CLI in CI workflows that outside users can trigger via issues or PRs, update immediately to Claude Code 2.1.163, Gemini CLI 0.39.1, and run-gemini-cli 0.1.22, then audit which workflows accept untrusted input. The Gemini host-execution bug didn't even require prompt manipulation — a crafted .env file was enough. The deeper lesson: the harness code around the model (validators, allowlists, sandbox launchers) is where these failures cluster, not the model itself — Gemini CLI's tool allowlist was only checked at registration and ignored at runtime under --yolo.
Discussion angle
The harness is the attack surface: how to audit the code between your AI agent and the real world — validators that strip before checking, allowlists enforced only at registration, and sandbox boundaries that a .env file can cross before the sandbox even starts.