The incident: CVE-2026-12537
Gemini CLI running headless in CI “automatically trusted workspace folders for the purpose of loading configuration and environment variables”, and under --yolo it “would ignore any fine grained tool allowlist” (GitHub advisory). A workflow reviewing a user-submitted pull request therefore loaded that pull request’s own Gemini configuration.
Google scored it 10.0 (CVSS 3.1), and NVD 7.8. It was fixed in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22, which now require workflows to trust the workspace explicitly.