TLDR Tech / InfoSec
Pre-Task RCE in Google Gemini CLI (CVE-2026-12537)
Novee researchers disclosed a CVSS 10.0 pre-task RCE in Gemini CLI where GEMINI_SANDBOX_PROXY_COMMAND in .gemini/.env reached a host shell via spawn(..., { shell: true }) before the sandbox even started, exposing all parent process secrets (GITHUB_TOKEN, GEMINI_API_KEY) and bypassing four defensive layers. The same pre-task execution pattern appeared in Claude Code (execution before the trust dialog) and Codex (MCP auto-launch before the model), revealing a shared architectural blind spot: workspace configuration influences process authority before model-time guardrails activate. The exploit required no prompt injection—three lines in a configuration file were sufficient for host-level code execution.
Read the full story