{
 "id": "AIR-2026-1236",
 "slug": "cve-2026-54785-local-file-read-vulnerability-in-gemini-bridg",
 "title": "CVE-2026-54785: Local file read vulnerability in gemini-bridge MCP server",
 "summary": "The gemini-bridge MCP server prior to version 1.3.1 allowed unconstrained file paths to be read and forwarded to the Gemini CLI, resulting in arbitrary local file read. The issue has been fixed in version 1.3.1.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "gemini-bridge"
 ],
 "incident_date": "2026-07-31",
 "incident_date_precision": "day",
 "first_reported": "2026-07-31",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54785",
   "publisher": "NVD",
   "title": "CVE-2026-54785: gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI.",
   "published_at": "2026-07-31"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-54785",
  "mcp",
  "local-file-read"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}