{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0007",
  "aliases": [
    "CVE-2026-12537"
  ],
  "published": "2026-09-19T00:00:00Z",
  "modified": "2026-09-20T02:45:17.577Z",
  "summary": "Gemini CLI can execute commands from repository settings",
  "details": "## What the vulnerability is\n\nGemini CLI can execute commands from repository-controlled settings when it processes a project configuration. The lockfile represents that configuration as a project-scoped settings file, while the repository convention is a `.gemini` directory. This record uses `0.39.1` as the fixed release boundary, pending confirmation.\n\n## Which configuration is exposed\n\nThe matcher requires `harness.id` `gemini-cli`, a version below `0.39.1`, and at least one `settingsFiles` entry with `scope` `project`. These are the exact conditions encoded. The matcher does not require a particular setting key or command and does not prove that the project file came from an attacker; it is a static proxy for repository-controlled Gemini CLI configuration.\n\n## How ACVE detects it\n\nACVE reads `harness.id`, `harness.version`, and `settingsFiles[].scope`. It cannot inspect the `.gemini` contents, identify a command, establish whether the settings were loaded, or determine whether the repository is trusted. A project settings match is therefore a broad exposure signal.\n\n## Fix\n\n1. Upgrade Gemini CLI to `0.39.1` or later after confirming the exact fixed release.\n2. Review repository `.gemini` settings before opening the project and remove command-bearing configuration that is not required.\n\n## Grounding needed\n\n`acve advisory ground` must confirm the affected Gemini CLI range and exact fixed release for `CVE-2026-12537`.\n\nThe matcher cannot distinguish a harmless project settings file from one that causes command execution, which is why review remains part of the fix.\n\nA review of the repository settings is still required because the matcher records scope, not the commands or values contained in that scope.\n\n## References\n\nSee `references` for primary sources.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "gemini-cli"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.39.1"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12537"
    },
    {
      "type": "REPORT",
      "url": "https://example.com/research/acve"
    },
    {
      "type": "FIX",
      "url": "https://github.com/pickbitsai/acve/issues?q=CVE-2026-12537"
    }
  ],
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "8"
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "published",
      "vulnClasses": [
        "command-injection"
      ],
      "cwe": [
        "CWE-78"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI05 Improper Output Handling"
        ],
        "atlas": [
          "AML.T0051"
        ]
      },
      "matcher": {
        "all": [
          {
            "field": "harness.id",
            "op": "eq",
            "value": "gemini-cli"
          },
          {
            "field": "harness.version",
            "op": "semverRange",
            "value": "<0.39.1"
          },
          {
            "some": "settingsFiles",
            "where": {
              "field": "scope",
              "op": "eq",
              "value": "project"
            }
          }
        ]
      },
      "fix": {
        "summary": "Upgrade Gemini CLI to the confirmed fixed release and review repository settings.",
        "actions": [
          {
            "type": "upgrade",
            "target": "harness:gemini-cli",
            "to": "0.39.1",
            "why": "Use the fixed release."
          }
        ]
      },
      "exposure": "repo-controlled",
      "exploitation": {
        "vector": "malicious project or server configuration",
        "userInteraction": "required",
        "kev": false
      },
      "grounding": {
        "osv": {
          "checkedAt": "2026-09-20T02:43:29Z",
          "found": true,
          "aliasesConfirmed": [
            "CVE-2026-12537",
            "CVE-2026-13745",
            "GHSA-wpqr-6v78-jr5g"
          ],
          "packagesConfirmed": [],
          "fixedVersionsConfirmed": [],
          "cvss": [
            {
              "type": "CVSS_V3",
              "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
            }
          ]
        },
        "nvd": {
          "checkedAt": "2026-09-20T02:43:29Z",
          "found": false,
          "cvss": null,
          "published": null
        },
        "kev": {
          "checkedAt": "2026-09-20T02:43:29Z",
          "listed": false
        },
        "registry": {
          "checkedAt": "2026-09-20T02:43:29Z",
          "confirmed": [],
          "missing": []
        }
      },
      "validatedBy": [
        {
          "who": "Mark Pickering (PickBits) via Claude Code session 01YR6ri2tM3jU9vdQNe9R5pw",
          "date": "2026-09-20",
          "method": "vendor-advisory",
          "evidence": "https://osv.dev/vulnerability/CVE-2026-12537",
          "note": "Gemini CLI < 0.39.1 container-launcher command injection; OSV record found by grounding."
        }
      ]
    }
  }
}