{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0013",
  "aliases": [],
  "published": "2026-09-19T00:00:00Z",
  "modified": "2026-09-19T00:00:00Z",
  "summary": "Gemini CLI README injection can reach allowlisted tools",
  "details": "## What the vulnerability is\n\nThe Tracebit reference describes a Gemini CLI README-injection path that can reach tools which the harness allowlists. The security concern is that repository documentation can influence the agent's instructions and reach a tool boundary intended to be limited by configuration. The current reference URL is a blog index rather than a versioned advisory, so the claimed affected release remains provisional.\n\n## Which configuration is exposed\n\nThe matcher requires `harness.id` `gemini-cli` and the presence of `allowedTools`. That is the complete encoded condition; it does not require a particular README, tool name, repository, prompt, or version. The allowlist is a static proxy for a tool-chaining path, not proof that README content was delivered or that a listed tool executed.\n\n## How ACVE detects it\n\nACVE reads `harness.id` and the existence of `allowedTools`. It does not read README files, enumerate the allowlist contents, reproduce instruction processing, or observe a tool call. The seed currently treats Gemini CLI below `0.1.14` as relevant only in the accompanying fix proposal, not in the matcher, so version resolution cannot make this finding safe.\n\n## Fix\n\n1. Run grounding to confirm the reported affected version and fixed release.\n2. Upgrade Gemini CLI to the confirmed fixed release; `0.1.14` is the current tentative target (unverified — see Grounding needed).\n3. Review allowlisted tools and treat repository README content as untrusted instructions.\n\n## Grounding needed\n\n`acve advisory ground` must confirm the README-injection claim, the affected and fixed Gemini CLI versions, and whether `0.1.14` is the correct upgrade target.\n\n## References\n\nSee `references` for primary sources.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "gemini-cli"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://tracebit.com/blog/"
    },
    {
      "type": "REPORT",
      "url": "https://tracebit.com/blog/"
    }
  ],
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "5"
    }
  ],
  "database_specific": {
    "severity": "MODERATE",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "taxonomy": {
        "owasp_asi": [
          "ASI01 Agent Goal Hijack"
        ],
        "atlas": [
          "AML.T0051"
        ]
      },
      "exploitation": {
        "vector": "malicious project or server configuration",
        "userInteraction": "required",
        "kev": false
      },
      "exposure": "local",
      "vulnClasses": [
        "prompt-injection-to-tool"
      ],
      "cwe": [
        "CWE-94"
      ],
      "matcher": {
        "all": [
          {
            "field": "harness.id",
            "op": "eq",
            "value": "gemini-cli"
          },
          {
            "field": "allowedTools",
            "op": "exists"
          }
        ]
      },
      "fix": {
        "summary": "Ground the Gemini CLI release, then upgrade and review allowlisted tools.",
        "actions": [
          {
            "type": "upgrade",
            "target": "harness:gemini-cli",
            "to": "0.1.14",
            "why": "Use the confirmed fixed release for the README-injection claim."
          }
        ]
      },
      "noCveReason": "ACVE-native configuration weakness; no CVE assigned.",
      "grounding": {
        "osv": {
          "checkedAt": "2026-09-20T02:43:30Z",
          "found": false,
          "aliasesConfirmed": [],
          "packagesConfirmed": [],
          "fixedVersionsConfirmed": [],
          "cvss": []
        },
        "nvd": {
          "checkedAt": "2026-09-20T02:43:30Z",
          "found": false,
          "cvss": null,
          "published": null
        },
        "kev": {
          "checkedAt": "2026-09-20T02:43:30Z",
          "listed": false
        },
        "registry": {
          "checkedAt": "2026-09-20T02:43:30Z",
          "confirmed": [],
          "missing": []
        }
      }
    }
  }
}