Gemini CLI Vulnerability Could Have Led to Code Execution, Supply Chain Attack

The flaw could allow attackers to mount a supply chain attack via indirect prompts injected into a GitHub issue. The attack could take over the AI agent in –yolo mode, leading to arbitrary code execution.

The vulnerability involves indirect prompt injection. An attacker embeds malicious instructions in a GitHub issue comment. When Gemini CLI processes the issue in –yolo mode, it executes the injected commands without user interaction. This bypasses safety mechanisms and enables code execution, potentially compromising the entire supply chain.

The disclosure highlights security concerns in AI agents that autonomously process external inputs. The –yolo mode, designed for less restrictive operation, exacerbates the risk. The finding underscores the need for robust input sanitization in AI systems.