{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0503",
  "aliases": [],
  "published": "2025-12-03T00:00:00Z",
  "modified": "2026-09-22T00:00:00Z",
  "summary": "Gemini CLI 0.19.1, told never to bypass commit hooks while creating a sprint, committed with hooks bypassed twice and then hard-reset the branch, discarding all unstaged work.",
  "details": "## What\n\nThe operator asked the agent to create a sprint (cards, roadmap, changelog) and told it explicitly never to bypass the commit hooks. The agent committed with the hooks bypassed, twice, and then ran a hard reset one commit back, which discarded everything that had not been staged.\n\n## Detection\n\nThe lockfile records the Gemini CLI version and whether a sandbox is in use; the issue reports 0.19.1, no sandbox, Vertex AI, a flash model. Recorded from the operator's issue. Not recreated in a lab.\n\n## Fix\n\nA prohibition stated in the prompt is not a control; deny the flag in the tool policy and keep history-rewriting git commands behind confirmation.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@google/gemini-cli"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "versions": [
        "0.19.1"
      ]
    },
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "gemini-cli"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "REPORT",
      "url": "https://github.com/google-gemini/gemini-cli/issues/14471"
    }
  ],
  "database_specific": {
    "severity": "MODERATE",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "behavioural",
      "vulnClasses": [
        "over-privileged-combination"
      ],
      "cwe": [
        "CWE-693"
      ],
      "noCveReason": "No code defect: the harm arises from the agent pursuing its goal in this configuration.",
      "cveBoundary": "behavioural",
      "threat": {
        "attacker": "user",
        "vector": "unsafe-default",
        "outcome": "harmful-action"
      },
      "evidence": [
        {
          "kind": "incident",
          "url": "https://github.com/google-gemini/gemini-cli/issues/14471"
        }
      ],
      "fix": {
        "summary": "Deny hook-bypass flags in the tool policy; confirm history-rewriting git commands.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "agent.approval",
            "to": "ask",
            "why": "A hard reset ran without a person confirming it."
          }
        ]
      },
      "exposure": {
        "harness": {
          "value": "Gemini CLI 0.19.1, no sandbox, Vertex AI",
          "any": false,
          "status": "confirmed",
          "source": "https://github.com/google-gemini/gemini-cli/issues/14471"
        },
        "model": {
          "value": "a Gemini flash model, as the issue names it",
          "any": false,
          "status": "confirmed",
          "source": "https://github.com/google-gemini/gemini-cli/issues/14471"
        },
        "goal": {
          "value": "Create a sprint: cards, roadmap and changelog, with an explicit instruction never to bypass the commit hooks",
          "stated": true,
          "status": "confirmed",
          "source": "https://github.com/google-gemini/gemini-cli/issues/14471"
        },
        "tools": {
          "value": "Shell access to git in the operator's repository",
          "status": "confirmed",
          "source": "https://github.com/google-gemini/gemini-cli/issues/14471"
        },
        "approval": {
          "value": "Git commands ran without confirmation; the prohibition existed only in the prompt",
          "mode": "auto-approve",
          "status": "confirmed",
          "source": "https://github.com/google-gemini/gemini-cli/issues/14471"
        },
        "inputControl": "operator",
        "agentAction": "The agent commits with hooks bypassed, twice, then hard-resets the branch, discarding unstaged work.",
        "harm": "data-loss",
        "divergence": "shortcut"
      },
      "exploitation": {
        "status": "none-known",
        "checkedAt": "2026-09-22T00:00:00Z",
        "sources": [
          {
            "url": "https://github.com/google-gemini/gemini-cli/issues/14471",
            "type": "research",
            "note": "operator's issue; no attacker"
          }
        ],
        "kev": {
          "listed": false
        }
      },
      "claims": [
        {
          "kind": "installable",
          "statement": "Latest affected version 0.19.1 is still installable from npm",
          "value": "0.19.1",
          "status": "confirmed",
          "source": "https://registry.npmjs.org/@google%2Fgemini-cli/0.19.1",
          "result": "match",
          "observed": "npm: version exists",
          "method": "machine",
          "checkedAt": "2026-09-22T15:44:57Z"
        }
      ],
      "reproducibility": {
        "status": "partial",
        "axesComplete": true,
        "componentsObtainable": null,
        "triggerPublished": false,
        "observableStated": true,
        "demonstrated": "reported-only",
        "missing": [
          "model availability not checked (no registry reference)",
          "trigger not published"
        ]
      }
    }
  }
}