{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0502",
  "aliases": [],
  "published": "2025-07-21T00:00:00Z",
  "modified": "2026-09-22T00:00:00Z",
  "summary": "Gemini CLI 0.1.13, asked to rename a folder and relocate its files, reported a directory creation that never happened and then relocated the files into a destination that did not exist, destroying them.",
  "details": "## What\n\nThe operator asked the agent to rename a project folder and relocate all its files into a new one. The command to create the destination folder returned success but never created it. The agent then relocated the files into that nonexistent destination, so each file overwrote the previous one under a single name and the contents were lost. The agent's own post-mortem in the transcript acknowledged the sequence.\n\n## Detection\n\nThe lockfile records the Gemini CLI version; the issue reports version 0.1.13, model gemini-2.5-pro, no sandbox. Recorded from the operator's issue and attached transcript. Not recreated in a lab.\n\n## Fix\n\nVerify that a destination exists before relocating files into it, and keep file operations behind confirmation in unsandboxed sessions.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@google/gemini-cli"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "versions": [
        "0.1.13"
      ]
    },
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "gemini-cli"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "REPORT",
      "url": "https://github.com/google-gemini/gemini-cli/issues/4586"
    },
    {
      "type": "EVIDENCE",
      "url": "https://github.com/user-attachments/files/21372906/gemini.cli.screw.up.txt"
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "behavioural",
      "vulnClasses": [
        "over-privileged-combination"
      ],
      "cwe": [
        "CWE-693"
      ],
      "noCveReason": "No code defect reported by the vendor: the harm arises from the agent acting on a failed step as if it had succeeded.",
      "cveBoundary": "behavioural",
      "threat": {
        "attacker": "user",
        "vector": "unsafe-default",
        "outcome": "file-write"
      },
      "evidence": [
        {
          "kind": "incident",
          "url": "https://github.com/google-gemini/gemini-cli/issues/4586"
        }
      ],
      "fix": {
        "summary": "Confirm file relocation in unsandboxed sessions; verify the destination exists first.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "agent.approval",
            "to": "ask",
            "why": "The relocation ran without a person checking the destination."
          }
        ]
      },
      "exposure": {
        "harness": {
          "value": "Gemini CLI 0.1.13, no sandbox",
          "any": false,
          "status": "confirmed",
          "source": "https://github.com/google-gemini/gemini-cli/issues/4586"
        },
        "model": {
          "value": "gemini-2.5-pro",
          "any": false,
          "status": "confirmed",
          "source": "https://github.com/google-gemini/gemini-cli/issues/4586"
        },
        "goal": {
          "value": "Rename the project folder and relocate all its existing files into a new folder",
          "stated": true,
          "status": "confirmed",
          "source": "https://github.com/google-gemini/gemini-cli/issues/4586"
        },
        "tools": {
          "value": "Shell file operations on the operator's Windows machine, with no sandbox",
          "status": "confirmed",
          "source": "https://github.com/google-gemini/gemini-cli/issues/4586"
        },
        "approval": {
          "value": "File operations ran without confirmation in an unsandboxed session",
          "mode": "auto-approve",
          "status": "confirmed",
          "source": "https://github.com/user-attachments/files/21372906/gemini.cli.screw.up.txt"
        },
        "inputControl": "operator",
        "agentAction": "The agent relocates every file into a destination that was never created, overwriting them under one name.",
        "harm": "data-loss",
        "divergence": "instruction-followed"
      },
      "exploitation": {
        "status": "none-known",
        "checkedAt": "2026-09-22T00:00:00Z",
        "sources": [
          {
            "url": "https://github.com/google-gemini/gemini-cli/issues/4586",
            "type": "research",
            "note": "operator's issue with the full transcript; no attacker"
          }
        ],
        "kev": {
          "listed": false
        }
      },
      "claims": [
        {
          "kind": "installable",
          "statement": "Latest affected version 0.1.13 is still installable from npm",
          "value": "0.1.13",
          "status": "confirmed",
          "source": "https://registry.npmjs.org/@google%2Fgemini-cli/0.1.13",
          "result": "match",
          "observed": "npm: version exists",
          "method": "machine",
          "checkedAt": "2026-09-22T15:44:57Z"
        }
      ],
      "reproducibility": {
        "status": "partial",
        "axesComplete": true,
        "componentsObtainable": null,
        "triggerPublished": true,
        "observableStated": true,
        "demonstrated": "reported-only",
        "missing": [
          "model availability not checked (no registry reference)"
        ]
      }
    }
  }
}