Improper neutralization of an operating‑system command in the container launcher of Gemini CLI and its GitHub Action allows an attacker to inject a malicious .gemini or .env file, resulting in pre‑sandbox, host‑level code execution. The flaw comes from accepting untrusted data without validation, enabling an unprivileged attacker to run arbitrary commands on the CI host machine.

Google Cloud Gemini CLI (versions before 0.39.1) and the run‑gemini‑cli GitHub Action (versions before 0.1.22) on headless CI platforms are affected. Users of these tools that rely on CI environments run by non‑privileged pipelines are at risk.

The vulnerability was scored CVSS 10, indicating a critical impact. While no EPSS score is available, the lack of a KEV listing does not reduce the likelihood of exploitation, because the attack vector is a supply‑chain style injection of a crafted file that can be included in any CI workflow. An unprivileged attacker who can influence the contents of the .gemini/.env file on a CI host can achieve host‑level code execution, breaking confidentiality, integrity, and availability of the build environment.