ACVE-2026-0013

The configuration

Configuration label

gemini-cli

Affected entries

• AgentHarness: gemini-cli — SEMVER (introduced 0)

Matcher

• all
  • harness.id eq "gemini-cli"
  • allowedTools exists

Why it is exploitable

What the vulnerability is

The Tracebit reference describes a Gemini CLI README-injection path that can reach tools which the harness allowlists. The security concern is that repository documentation can influence the agent's instructions and reach a tool boundary intended to be limited by configuration. The current reference URL is a blog index rather than a versioned advisory, so the claimed affected release remains provisional.

Which configuration is exposed

The matcher requires harness.id gemini-cli and the presence of allowedTools. That is the complete encoded condition; it does not require a particular README, tool name, repository, prompt, or version. The allowlist is a static proxy for a tool-chaining path, not proof that README content was delivered or that a listed tool executed.

How ACVE detects it

ACVE reads harness.id and the existence of allowedTools. It does not read README files, enumerate the allowlist contents, reproduce instruction processing, or observe a tool call. The seed currently treats Gemini CLI below 0.1.14 as relevant only in the accompanying fix proposal, not in the matcher, so version resolution cannot make this finding safe.

Fix

1. Run grounding to confirm the reported affected version and fixed release.
2. Upgrade Gemini CLI to the confirmed fixed release; 0.1.14 is the current tentative target (unverified — see Grounding needed).
3. Review allowlisted tools and treat repository README content as untrusted instructions.

Grounding needed

acve advisory ground must confirm the README-injection claim, the affected and fixed Gemini CLI versions, and whether 0.1.14 is the correct upgrade target.

References

See references for primary sources.

Underlying CVEs / aliases

No CVE assigned. ACVE-native configuration weakness; no CVE assigned.

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Ground the Gemini CLI release, then upgrade and review allowlisted tools.

Validation

No validation entries recorded.

Grounding

• OSV: not found; checked-at 2026-09-20T02:43:30Z
• NVD: not found; checked-at 2026-09-20T02:43:30Z
• KEV: not listed in KEV; checked-at 2026-09-20T02:43:30Z

References

ADVISORY

• https://tracebit.com/blog/

REPORT

• https://tracebit.com/blog/