{"id":"CVE-2026-54785","aliases":["EUVD-2026-51677","GHSA-c5px-58j2-7fqp","PYSEC-2026-3574"],"status":"published","title":"gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode","description":"gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip (and sent to Google), making this an arbitrary local file read. This issue is fixed in version 1.3.1.","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00191,"percentile":0.08837,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-22"],"published":"2026-07-31T22:31:04Z","modified":"2026-10-28T02:30:44Z","fixes":[{"ecosystem":"PyPI","package":"gemini-bridge","fixed_in":["1.3.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"gemini-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.3.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"gemini-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.3.1"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.5","1.1.0","1.1.1","1.2.0","1.3.0"]},{"source":"osv","ecosystem":"PyPI","package":"gemini-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.3.1"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.5","1.1.0","1.1.1","1.2.0","1.3.0"]}],"products":[{"vendor":"elyin","product":"gemini-bridge"}],"references":[{"url":"https://github.com/eLyiN/gemini-bridge/security/advisories/GHSA-c5px-58j2-7fqp","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/eLyiN/gemini-bridge/pull/9","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/eLyiN/gemini-bridge/commit/8f3b85afd02b692c4bc974b5176e12fb277ea801","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/eLyiN/gemini-bridge/releases/tag/v1.3.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-c5px-58j2-7fqp","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54785.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54785","tags":["advisory"]},{"url":"https://github.com/eLyiN/gemini-bridge","tags":["package"]},{"url":"https://pypi.org/project/gemini-bridge","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-54785","title":"gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode","description":"gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip (and sent to Google), making this an arbitrary local file read. This issue is fixed in version 1.3.1.","status":"published","published":"2026-07-31T22:31:04.19Z","modified":"2026-08-03T16:26:53.194Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22","CWE-200"],"updated_at":"2026-11-02T13:37:58.613221Z"}],"euvd":[{"id":"EUVD-2026-51677","description":"gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip (and sent to Google), making this an arbitrary local file read. This issue is fixed in version 1.3.1.","status":"published","published":"2026-07-31T22:31:04Z","modified":"2026-08-03T16:26:53Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:24.366648Z"}],"ghsa":[{"id":"GHSA-c5px-58j2-7fqp","title":"gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode","description":"### Summary\n`consult_gemini_with_files` in **inline mode** read any file path supplied in\nthe `files` argument without confining it to the working `directory`, then\nforwarded the contents to the Gemini CLI. Because the caller also controls\n`query`, the file contents are echoed back through the Gemini round-trip\n(and sent to Google), making this an arbitrary local file read.\n\n### Impact\nAn MCP client — or an LLM that has been prompt-injected into calling the tool —\ncan read **any file the server process can access** (SSH keys, cloud\ncredentials, `.env`, source) and have it disclosed via the tool response.\nNo code execution by itself.\n\n### Affected component\n- Tool: `consult_gemini_with_files(query, directory, files, …)`, `mode=\"inline\"`\n- Sink: `_read_file_for_inline` via `_prepare_inline_payload` in `src/mcp_server.py`\n- The `at_command` mode already confined paths; inline mode did not.\n\n### Root cause\n`_resolve_path` returned an out-of-root path while only nullifying the *display*\nname, and `_prepare_inline_payload` read the file regardless. Absolute paths,\n`..` traversal, and symlink escapes were all accepted.\n\n### Patch\nFixed in **1.3.1**. `_resolve_path` now resolves symlinks and confines via\n`Path.relative_to(root)`; inline mode skips any entry that resolves outside the\nworking directory (the same guard `at_command` already enforced).\n\n### Workarounds\nUpgrade to 1.3.1. Before upgrading, avoid `mode=\"inline\"` with untrusted\n`files` input, or run the server with a restricted-permission user.\n\n### Credit\nReported privately by Zhihao Zhang (WPI).","status":"published","published":"2026-07-31T22:31:20Z","modified":"2026-07-31T22:31:21Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22","CWE-200"],"updated_at":"2026-11-02T14:40:55.903445Z"}],"nvd":[{"id":"CVE-2026-54785","description":"gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip (and sent to Google), making this an arbitrary local file read. This issue is fixed in version 1.3.1.","status":"published","published":"2026-07-31T23:17:25.133Z","modified":"2026-10-23T23:10:00.157Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-22","CWE-200"],"updated_at":"2026-11-02T14:12:34.290716Z"}],"osv":[{"id":"CVE-2026-54785","title":"gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode","description":"gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip (and sent to Google), making this an arbitrary local file read. This issue is fixed in version 1.3.1.","status":"published","published":"2026-07-31T22:31:04.19Z","modified":"2026-10-28T02:30:44.706756981Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-22"],"updated_at":"2026-11-02T15:45:10.818486Z"},{"id":"GHSA-c5px-58j2-7fqp","title":"gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode","description":"### Summary\n`consult_gemini_with_files` in **inline mode** read any file path supplied in\nthe `files` argument without confining it to the working `directory`, then\nforwarded the contents to the Gemini CLI. Because the caller also controls\n`query`, the file contents are echoed back through the Gemini round-trip\n(and sent to Google), making this an arbitrary local file read.\n\n### Impact\nAn MCP client — or an LLM that has been prompt-injected into calling the tool —\ncan read **any file the server process can access** (SSH keys, cloud\ncredentials, `.env`, source) and have it disclosed via the tool response.\nNo code execution by itself.\n\n### Affected component\n- Tool: `consult_gemini_with_files(query, directory, files, …)`, `mode=\"inline\"`\n- Sink: `_read_file_for_inline` via `_prepare_inline_payload` in `src/mcp_server.py`\n- The `at_command` mode already confined paths; inline mode did not.\n\n### Root cause\n`_resolve_path` returned an out-of-root path while only nullifying the *display*\nname, and `_prepare_inline_payload` read the file regardless. Absolute paths,\n`..` traversal, and symlink escapes were all accepted.\n\n### Patch\nFixed in **1.3.1**. `_resolve_path` now resolves symlinks and confines via\n`Path.relative_to(root)`; inline mode skips any entry that resolves outside the\nworking directory (the same guard `at_command` already enforced).\n\n### Workarounds\nUpgrade to 1.3.1. Before upgrading, avoid `mode=\"inline\"` with untrusted\n`files` input, or run the server with a restricted-permission user.\n\n### Credit\nReported privately by Zhihao Zhang (WPI).","status":"published","published":"2026-07-31T22:31:20Z","modified":"2026-08-04T14:40:57.76337811Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-22"],"updated_at":"2026-11-02T15:46:44.571161Z"},{"id":"PYSEC-2026-3574","title":"gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode","description":"### Summary\n`consult_gemini_with_files` in **inline mode** read any file path supplied in\nthe `files` argument without confining it to the working `directory`, then\nforwarded the contents to the Gemini CLI. Because the caller also controls\n`query`, the file contents are echoed back through the Gemini round-trip\n(and sent to Google), making this an arbitrary local file read.\n\n### Impact\nAn MCP client — or an LLM that has been prompt-injected into calling the tool —\ncan read **any file the server process can access** (SSH keys, cloud\ncredentials, `.env`, source) and have it disclosed via the tool response.\nNo code execution by itself.\n\n### Affected component\n- Tool: `consult_gemini_with_files(query, directory, files, …)`, `mode=\"inline\"`\n- Sink: `_read_file_for_inline` via `_prepare_inline_payload` in `src/mcp_server.py`\n- The `at_command` mode already confined paths; inline mode did not.\n\n### Root cause\n`_resolve_path` returned an out-of-root path while only nullifying the *display*\nname, and `_prepare_inline_payload` read the file regardless. Absolute paths,\n`..` traversal, and symlink escapes were all accepted.\n\n### Patch\nFixed in **1.3.1**. `_resolve_path` now resolves symlinks and confines via\n`Path.relative_to(root)`; inline mode skips any entry that resolves outside the\nworking directory (the same guard `at_command` already enforced).\n\n### Workarounds\nUpgrade to 1.3.1. Before upgrading, avoid `mode=\"inline\"` with untrusted\n`files` input, or run the server with a restricted-permission user.\n\n### Credit\nReported privately by Zhihao Zhang (WPI).","status":"published","published":"2026-08-04T11:34:46.654048Z","modified":"2026-08-04T14:30:16.463267474Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:56.847083Z"}]}}