Disclosed vulnerability
From a public GitHub issue to commits on gemini-cli's main branch: --yolo mode ignored the fine-grained tool allowlist in the triage workflow
AIR-2026-0096 AIR record · 2026-05-google-gemini-cli-yolo-supply-chain
From the supporting source
Tool allowlists now enforced under --yolo mode. Previously, running Gemini CLI with --yolo caused it to ignore any fine-grained tool allowlist in settings.json.pillar.security
The record
Disclosed
2026-04-24
Vendor
Google
Product
Gemini CLI (@google/gemini-cli) and run-gemini-cli GitHub Action
Risk domain
Access control and permissions › Credential theft
Also touches
Privilege escalation, Supply chain vulnerabilities, Confused deputy
System type
Generative model
Who acted
Agent acted — the CI agent executed and pushed commits to main under --yolo
Attack surface
Coding agent
Autonomy level
Fully autonomous
Initial vector
Indirect prompt injection github issue
Impact type
Supply chain compromise, Credential theft, Remote code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
all downstream users of gemini-cli (repo has 101k+ stars)
Capability abused
Defense & remediation
Recorded defense
fine-grained tool allowlist in settings.json
Guardrail kinds
Permission scope
Guardrail outcome
Silent
Fix shipped
gemini-cli 0.39.1 / 0.40.0-preview.3; run-gemini-cli action 0.1.22; advisory GHSA-wpqr-6v78-jr5g published 2026-04-24
Taxonomy & references
Curator notes
Pillar Security (Dan Lisichkin). Reported 2026-04-16, advisory 2026-04-24, blog 2026-05-05. Same repo and broadly the same entry point as 2026-08-google-gemini-cli-wif-gcp-compromise but a different defect and different escalation path (supply-chain commit vs GCP privilege escalation). Credential persistence in the runner's git config is what turned RCE into a supply-chain write. Update 2026-09-21: CVE-2026-13745 was assigned to this advisory (GHSA-wpqr-6v78-jr5g); NVD describes arbitrary code execution in Gemini CLI via untrusted local .env files overriding GEMINI_CLI_HOME, fixed in run-gemini-cli 0.1.22.
Supporting sources
Cite as
Enkrypt AI. "From a public GitHub issue to commits on gemini-cli's main branch: --yolo mode ignored the fine-grained tool allowlist in the triage workflow". AIR, AIR-2026-0096. https://agentincident.vercel.app/i/AIR-2026-0096/ (accessed 2026-10-19).