{
 "id": "TR-2026-004",
 "status": "published",
 "title": "Gemini CLI: a README plus an allow-list bypass gives silent command execution",
 "date": "2025-07-28",
 "window": "Disclosed 28 Jul 2025; fixed in Gemini CLI 0.1.14",
 "ai_role": "target",
 "category": "red_team",
 "summary": "A repository README carries hidden instructions; a benign command the user had allow-listed is chained with a second command that exfiltrates environment variables, with output padded so the user sees nothing. Fixed in Gemini CLI 0.1.14.",
 "attacker": {
  "description": "Security researchers (Tracebit), proof of concept"
 },
 "defender": {
  "description": "Google — fixed in Gemini CLI 0.1.14"
 },
 "scale": "Environment variables (credentials) on the developer's machine",
 "impact": "Silent code execution and credential exfiltration",
 "tactics": [
  "TA0002",
  "TA0005",
  "TA0010"
 ],
 "timeline": [
  {
   "date": "2025-07-28",
   "text": "Tracebit discloses the Gemini CLI allow-list bypass; Google has fixed it in 0.1.14",
   "tier": 2,
   "source": "1"
  }
 ],
 "lessons": [
  "An allow-listed command is not a safe command once an agent can append to it — validate the full command, not a prefix.",
  "A file in the opened repo is untrusted input to a coding agent; a README can carry the attack."
 ],
 "models_named": [],
 "related_agents": [
  "google-gemini-cli"
 ],
 "vendor_response": "Fixed in 0.1.14 (July 2025)",
 "sources": [
  {
   "title": "Using deception to catch a Gemini CLI hijack",
   "url": "https://tracebit.com/blog/code-exec-deception-gemini-ai-cli-hijack",
   "outlet": "Tracebit",
   "date": "2025-07-28"
  }
 ],
 "reviewer": null,
 "checked_on": null
}