Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets
Summary: Novee Security showed that a GitHub issue from an account with no repository privileges could execute code on the CI runners behind Anthropic's and Google's coding-agent repositories, and hijack the next agent run on OpenAI's, using each vendor's default configuration; the work was presented at Black Hat USA on August 5. Two CVEs resulted, both patched: CVE-2026-12537 in Gemini CLI's container launcher (CVSS 4 score 10.0, fixed in 0.39.1 and run-gemini-cli 0.1.22) and CVE-2026-54316 in Claude Code, which leaked an API key one character at a time through Hugging Face's public download counter (fixed in 2.1.163, with every release from 0.2.54 up to 2.1.163 affected).
Why it matters: The Gemini flaw needed no model persuasion at all: a crafted .gemini/.env file ran code on the host before the sandbox started, and under --yolo every command the model asked for was auto-approved because the tool allowlist was only parsed at registration. Novee's finding is that the failure sat in the harness, the code between the model and the real world, where one part marked a value safe and a later part acted on it with more authority.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-12537CVE-2026-54316
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026