CVE-2026-12537 Google Gemini CLI .gemini/.env Path Injection Attempt

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

Detects attempts to exploit CVE-2026-12537 in the Google Gemini CLI, which allows for unauthorized manipulation of the .gemini/.env configuration file. The rule triggers on GET or POST requests attempting to access or modify this specific environment file, potentially enabling malicious environment variable injection.