Skip to content
Threat Feed
Subscribe

Product

Gemini CLI Extension (<= 1.0.0)

1 brief RSS
high advisory

ATXP Gemini CLI extension: OS command injection via MCP (CVE-2026-117560)

The ATXP Gemini CLI extension through version 1.0.0 is vulnerable to OS command injection in the runAtxp() function due to unsanitized MCP tool parameters, allowing arbitrary code execution.

Gemini CLI extension
1t 1c