{"id":"CVE-2026-0755","aliases":["EUVD-2026-4492","GHSA-28qq-5f47-r5x2","GHSA-4h5r-5jm8-jxjm"],"status":"published","title":"gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability","description":"gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of gemini-mcp-tool. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the execAsync method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27783.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0342,"percentile":0.89008,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2026-01-23T03:26:16Z","modified":"2026-06-18T21:11:28Z","fixes":[{"ecosystem":"npm","package":"gemini-mcp-tool","fixed_in":["1.1.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"gemini-mcp-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.2"},{"fixed":"1.1.6"}]}]},{"source":"osv","ecosystem":"npm","package":"gemini-mcp-tool","ranges":[{"type":"SEMVER","events":[{"introduced":"1.1.2"},{"fixed":"1.1.6"}]}]}],"products":[{"vendor":"gemini mcp tool","product":"gemini-mcp-tool"}],"references":[{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-021/","tags":["x_research-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0755","tags":["advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-021","tags":["web"]},{"url":"https://github.com/advisories/GHSA-28qq-5f47-r5x2"},{"url":"https://github.com/jamubc/gemini-mcp-tool/security/advisories/GHSA-4h5r-5jm8-jxjm","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4h5r-5jm8-jxjm"},{"url":"https://github.com/jamubc/gemini-mcp-tool","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-0755","title":"gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability","description":"gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of gemini-mcp-tool. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the execAsync method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27783.","status":"published","published":"2026-01-23T03:26:16Z","modified":"2026-01-23T19:35:07.197Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:20:13.587351Z"}],"euvd":[{"id":"EUVD-2026-4492","description":"gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of gemini-mcp-tool. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the execAsync method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27783.","status":"published","published":"2026-01-23T03:26:16Z","modified":"2026-01-23T19:35:07Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:48:48.084617Z"}],"ghsa":[{"id":"GHSA-28qq-5f47-r5x2","title":"Duplicate Advisory: gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-4h5r-5jm8-jxjm. This link is maintained to preserve external references.\n\n### Original Description\ngemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of gemini-mcp-tool. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the execAsync method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27783.","status":"withdrawn","published":"2026-01-23T06:31:23Z","modified":"2026-06-18T20:44:51Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:40:30.53004Z"},{"id":"GHSA-4h5r-5jm8-jxjm","title":"gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)","description":"Untrusted prompt input could reach the Gemini CLI @file parser, allowing read/exfiltration of arbitrary local files (@/etc/passwd, @~/.ssh/id_rsa, @../../secret). On Windows, unquoted cmd.exe metacharacters could break out into OS command injection.\n\nFix (1.1.6): removed the broken shell:false double-quote wrapping; added assertSafeFileReferences() to contain @file refs to the working directory; hardened Windows cmd.exe argument quoting.","status":"published","published":"2026-06-18T20:44:58Z","modified":"2026-06-18T20:44:59Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:40:30.53004Z"}],"nvd":[{"id":"CVE-2026-0755","description":"gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of gemini-mcp-tool. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the execAsync method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27783.","status":"published","published":"2026-01-23T04:16:02.017Z","modified":"2026-06-17T10:11:19.58Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:04.423757Z"}],"osv":[{"id":"GHSA-28qq-5f47-r5x2","title":"Duplicate Advisory: gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-4h5r-5jm8-jxjm. This link is maintained to preserve external references.\n\n### Original Description\ngemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of gemini-mcp-tool. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the execAsync method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27783.","status":"withdrawn","published":"2026-01-23T06:31:23Z","modified":"2026-06-18T21:00:15.909204902Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"GHSA-4h5r-5jm8-jxjm","title":"gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)","description":"Untrusted prompt input could reach the Gemini CLI @file parser, allowing read/exfiltration of arbitrary local files (@/etc/passwd, @~/.ssh/id_rsa, @../../secret). On Windows, unquoted cmd.exe metacharacters could break out into OS command injection.\n\nFix (1.1.6): removed the broken shell:false double-quote wrapping; added assertSafeFileReferences() to contain @file refs to the working directory; hardened Windows cmd.exe argument quoting.","status":"published","published":"2026-06-18T20:44:58Z","modified":"2026-06-18T21:11:28.349349Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:37.148947Z"}]}}