ACVE-2026-0007

The configuration

Configuration label

gemini-cli <0.39.1 + scope=project

Affected entries

• AgentHarness: gemini-cli — SEMVER (introduced 0; fixed 0.39.1)

Matcher

• all
  • harness.id eq "gemini-cli"
  • harness.version semverRange "<0.39.1"
  • some settingsFiles
    • scope eq "project"

Why it is exploitable

What the vulnerability is

Gemini CLI can execute commands from repository-controlled settings when it processes a project configuration. The lockfile represents that configuration as a project-scoped settings file, while the repository convention is a .gemini directory. This record uses 0.39.1 as the fixed release boundary, pending confirmation.

Which configuration is exposed

The matcher requires harness.id gemini-cli, a version below 0.39.1, and at least one settingsFiles entry with scope project. These are the exact conditions encoded. The matcher does not require a particular setting key or command and does not prove that the project file came from an attacker; it is a static proxy for repository-controlled Gemini CLI configuration.

How ACVE detects it

ACVE reads harness.id, harness.version, and settingsFiles[].scope. It cannot inspect the .gemini contents, identify a command, establish whether the settings were loaded, or determine whether the repository is trusted. A project settings match is therefore a broad exposure signal.

Fix

1. Upgrade Gemini CLI to 0.39.1 or later after confirming the exact fixed release.
2. Review repository .gemini settings before opening the project and remove command-bearing configuration that is not required.

Grounding needed

acve advisory ground must confirm the affected Gemini CLI range and exact fixed release for CVE-2026-12537.

The matcher cannot distinguish a harmless project settings file from one that causes command execution, which is why review remains part of the fix.

A review of the repository settings is still required because the matcher records scope, not the commands or values contained in that scope.

References

See references for primary sources.

Underlying CVEs / aliases

• CVE-2026-12537

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Upgrade Gemini CLI to the confirmed fixed release and review repository settings.

Validation

Grounding

• OSV: found; aliases: CVE-2026-12537, CVE-2026-13745, GHSA-wpqr-6v78-jr5g; checked-at 2026-09-20T02:43:29Z
• NVD: not found; checked-at 2026-09-20T02:43:29Z
• KEV: not listed in KEV; checked-at 2026-09-20T02:43:29Z

References

ADVISORY

• https://nvd.nist.gov/vuln/detail/CVE-2026-12537

REPORT

• https://example.com/research/acve

FIX

• https://github.com/pickbitsai/acve/issues?q=CVE-2026-12537