ATTXP Gemini CLI extension through 1.0.0 contains an OS command injection flaw in the runAtxp() function. Unsanitized MCP tool parameters such as message_id, subject, or query are passed directly to the shell, allowing an attacker to inject command substitutions like $(ls) or backticks. If an attacker can embed those substitutions in email or SMS content, the extension will execute the malicious commands as the user running the process, violating confidentiality, integrity, and availability. This flaw is categorized as CWE-78.

The affected product is the ATXP Gemini CLI extension, version 1.0.0 and earlier. The vulnerability exists in all deployments using this version of the open-source repository hosted at atxp-dev/atxp.

With a CVSS score of 8.5 the flaw is considered high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers need the ability to inject crafted content that reaches the runAtxp() routine, which may be achieved through an email or SMS channel. Because the parameters are unsanitized, the attacker can execute arbitrary commands with the privileges of the Gemini CLI process, potentially gaining full system compromise. The lack of authentication or input filtering makes exploitation highly feasible in environments where the extension is exposed.