ACVEAgent configuration vulnerability registry

Advisories › ACVE-2026-0502

ACVE-2026-0502

Gemini CLI 0.1.13, asked to rename a folder and relocate its files, reported a directory creation that never happened and then relocated the files into a destination that did not exist, destroying th…

Exposure

Harness
Gemini CLI 0.1.13, no sandbox — confirmed, github.com
Model
gemini-2.5-pro — confirmed, github.com
Goal
Rename the project folder and relocate all its existing files into a new folder — confirmed, github.com
Tools and settings
Shell file operations on the operator's Windows machine, with no sandbox — confirmed, github.com
Approval
File operations ran without confirmation in an unsandboxed session — confirmed, github.com
Input controlled by
operator
What the agent does
The agent relocates every file into a destination that was never created, overwriting them under one name.
Harm
data-loss

Reproducibility: partial (model availability not checked (no registry reference))

Severity
Susceptibility high
Status
Unverified
Kind
Behavioural
Published
2025-07-21
Modified
2026-09-22
Aliases
No CVE assigned — No code defect reported by the vendor: the harm arises from the agent acting on a failed step as if it had succeeded.
Affected
  • npm: @google/gemini-cli — all versions
  • AgentHarness: gemini-cli — all versions
Harness/product
@google/gemini-cli + gemini-cli
Classes
over-privileged-combination; CWE-693
Licence
CC-BY-4.0 advisories; MIT code

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

ClaimStatusSourceChecked
Latest affected version 0.1.13 is still installable from npmConfirmedregistry.npmjs.org2026-09-22

In the wild

none-known · research

Description

Threat

user · unsafe-default · file-write

What

The operator asked the agent to rename a project folder and relocate all its files into a new one. The command to create the destination folder returned success but never created it. The agent then relocated the files into that nonexistent destination, so each file overwrote the previous one under a single name and the contents were lost. The agent's own post-mortem in the transcript acknowledged the sequence.

Detection

The lockfile records the Gemini CLI version; the issue reports version 0.1.13, model gemini-2.5-pro, no sandbox. Recorded from the operator's issue and attached transcript. Not recreated in a lab.

Fix

Verify that a destination exists before relocating files into it, and keep file operations behind confirmation in unsandboxed sessions.

Not matched automatically. Check by hand.

Evidence

BenchmarkMetricValueAttemptsDefenceModelSource
——————https://github.com/google-gemini/gemini-cli/issues/4586

Fix

Confirm file relocation in unsandboxed sessions; verify the destination exists first.

  • Reconfigure agent.approval to ask. The relocation ran without a person checking the destination.

References

REPORT

EVIDENCE

Report a problemJSON