ATXP Gemini CLI extension: OS command injection via MCP (CVE-2026-117560)

The ATXP Gemini CLI extension version 1.0.0 and earlier contains an OS command injection vulnerability within the runAtxp() function. The vulnerability is triggered when the extension processes unsanitized input via Model Context Protocol (MCP) tool parameters, specifically targeting the message_id, subject, or query fields. An attacker can supply shell substitution characters, such as $() or backticks, within email or SMS content to force the extension to execute arbitrary commands under the context of the user running the CLI tool.

Impact

Successful exploitation allows an attacker to execute arbitrary shell commands with the privileges of the local user running the Gemini CLI extension, potentially leading to unauthorized data access, system modification, or persistence.

Recommendation

• Upgrade the ATXP Gemini CLI extension to a patched version beyond 1.0.0 immediately.
• Audit the use of MCP tools and restrict the processing of untrusted input content (email/SMS) if the extension cannot be updated.
• Implement monitoring for suspicious child processes spawned by the Gemini CLI tool.