CVE-2026-12537 GEMINI_TRUST_WORKSPACE=true Set in Untrusted Process Context
Detects the unauthorized injection of the 'GEMINI_TRUST_WORKSPACE=true' environment variable via process command lines or shell environments. This rule identifies potential exploitation attempts related to CVE-2026-12537 by flagging instances where this variable is set outside of defined, trusted CI/CD runner environments.
Microsoft Sentinel (KQL)
