{
 "id": "AIR-2026-0106",
 "slug": "cve-2026-13745-gemini-cli-untrusted-directory-arbitrary-code",
 "title": "CVE-2026-13745: Gemini CLI untrusted directory arbitrary code execution",
 "summary": "A vulnerability in Gemini CLI allows attackers to achieve arbitrary code execution by tricking victims into launching the CLI in untrusted directories containing malicious .env files. The flaw bypasses folder trust prompts and overrides configuration paths.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "Google",
  "framework_or_tooling"
 ],
 "products": [
  "Gemini CLI"
 ],
 "incident_date": "2026-09-10",
 "incident_date_precision": "day",
 "first_reported": "2026-09-10",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13745",
   "publisher": "NVD",
   "title": "CVE-2026-13745: A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a…",
   "published_at": "2026-09-10"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-13745",
  "gemini-cli",
  "remote-code-execution"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}