Gemini CLI

Sources: gemini-cli (GitHub) · run-gemini-cli action · GHSA-wpqr-6v78-jr5g

Google’s terminal-resident coding agent, published on npm as @google/gemini-cli. Its CI wrapper, the google-github-actions/run-gemini-cli Action, carries the wiki’s only maximum-severity coding-agent advisory.

Three surfaces matter here.

As a policy-enforcement target. Sondera’s Cedar hook harness enumerates Gemini CLI as one of three intercepted coding-agent surfaces. It is the only one of the three offering model-level hooks — before and after the model, permitting individual tokens to be streamed — where Claude Code exposes none and Cursor intercepts at the tool and shell layer instead. The multi-turn information-flow-control demo in that talk runs on Gemini CLI.

As a configuration tree. The harness reads a workspace-local .gemini/ directory for settings and environment, and a user-level ~/.gemini/settings.json carrying the fine-grained tool allowlist. Both are instances of harness config as supply-chain artifact, and the workspace-local one is where GHSA-wpqr-6v78-jr5g landed.

As a CI-runner agent. run-gemini-cli places the harness in the CI-runner shape — event-triggered, no human positioned to see an action before it executes. Two autonomy controls define its posture there: workspace trust, which since 0.39.1 must be granted explicitly through GEMINI_TRUST_WORKSPACE rather than inferred in headless mode, and --yolo, which auto-approves tool calls and, before the same release, also suppressed the tool allowlist.

Security Record

Date	Item	Severity
2026-04-24	Workspace-trust and `—yolo` allowlist bypasses (GHSA-wpqr-6v78-jr5g)	CVSS 10.0, patched in 0.39.1 / action 0.1.22