Attack Chain

1. Attacker creates a public issue on a Google-owned GitHub repository.
2. The attacker embeds malicious prompts within the text of the GitHub issue.
3. The AI agent (Gemini CLI) automatically triages the issue in -yolo mode.
4. Due to the bypassed allowlists, the injected malicious prompts are executed by the agent.
5. The agent extracts internal secrets from the build environment based on attacker instructions.
6. The agent sends the extracted secrets to an attacker-controlled server.
7. Using the stolen credentials, the attacker obtains a token with full write access to the repository.
8. The attacker pushes arbitrary code to the main branch of the gemini-cli repository, impacting all downstream users.

Impact

This vulnerability could have enabled a full supply chain compromise, potentially affecting all users of Gemini CLI and other repositories with the same vulnerable workflow templates. An attacker could inject malicious code into the gemini-cli repository, leading to widespread distribution of compromised software. The number of affected users and systems is unknown, but the potential impact is significant given the broad use of open-source tools and the high CVSS score.

Recommendation

• Upgrade to Gemini CLI version 0.39.1 or later to ensure proper tool allowlisting is enforced, as detailed in the overview.
• Review GitHub Action workflows for use of the run-gemini-cli action and ensure it is updated to the latest version, mitigating the vulnerability described in the overview.
• Monitor GitHub issue creation events for suspicious patterns indicative of prompt injection, helping to identify potential exploit attempts as outlined in the attack chain.
• Deploy the Sigma rule Detect Suspicious Gemini CLI Command Execution to detect command execution patterns associated with potential exploitation attempts.
• Deploy the Sigma rule Detect Gemini CLI Configuration File Access to monitor for unauthorized access to configuration files in headless mode, as mentioned in the overview.