CVE-2026-12537 Gemini CLI Spawning Shell Interpreters in CI/CD

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•0

Detects instances where the Gemini CLI (gemini-cli) is used to spawn system shell interpreters (e.g., cmd.exe, bash, powershell) within CI/CD runner environments. This pattern is associated with potential abuse of the Gemini CLI workspace trust bypass or 'yolo' mode, which can lead to unauthorized code execution.