Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets

Summary

Novee Security discovered vulnerabilities in Anthropic's Claude Code and Google's Gemini CLI that allowed unprivileged attackers to execute code on CI runners. The flaws, disclosed at Black Hat USA, led to two CVEs: CVE-2026-12537 for Gemini CLI (CVSS 10.0) and CVE-2026-54316 for Claude Code. OpenAI's Codex also had a vulnerability allowing workflow hijacking. All critical issues have been patched.

Full text

Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets Swati KhandelwalAug 07, 2026Artificial Intelligence / Vulnerability A GitHub issue opened by an account with no repository privileges was enough to execute code on the CI runners behind Anthropic's and Google's own coding-agent repositories. On OpenAI's, it was enough to hijack the next agent run. Novee Security ran the attack against each vendor's agent in the configuration that the vendor ships by default, and presented the work at Black Hat USA on August 5. Two CVEs came out of it. Both are patched. Gemini CLI carries the worst of the two. CVE-2026-12537 (CVSS 4 score: 10.0) is an OS command injection in the container launcher, reached through a crafted .gemini/.env file, which lets an unprivileged attacker run code on the host of a headless CI platform before the sandbox starts. It is fixed in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22. In Claude Code, CVE-2026-54316 turned Hugging Face's public download counter into an exfiltration channel that leaked an API key one character at a time, and is fixed in 2.1.163. Every Claude Code release from 0.2.54 up to 2.1.163 is affected. Anthropic says exploitation required getting untrusted content into a Claude Code context. The Codex finding produced neither a product-version patch nor a CVE. Novee says OpenAI's position is that its sandbox behaved exactly as documented. Update Gemini CLI to 0.39.1, run-gemini-cli to 0.1.22, and Claude Code to 2.1.163, then audit any workflow an outside user can trigger. The Gemini host-execution bug did not require talking a model into anything. Across all three, the recurring failure sat in the harness, the code around the model that decides what actually runs: one part marked a value safe, and a later part acted on that value with more authority. "The harness is the code between the model and the real world," Novee founding engineer Elad Meged wrote. Novee found that Claude Code's command validator strips single-quoted text before its 23 checks run, which is correct behavior for bash, so a payload in the value of git push --receive-pack, a flag git executes, reached the runner untouched. That chain has no CVE and no publicly stated fixed version. Gemini CLI parsed its tool allowlist only when registering the tool; at runtime nothing enforced it, and under --yolo every command the model asked for was auto-approved. Google addressed both that and the container-launcher flaw in one advisory, which says the fix "affects all Gemini CLI GitHub Actions." That advisory itself still shows no CVE; Google Cloud published the identifier separately as CNA, pointing back to it. Anthropic rates the Claude Code flaw Moderate at CVSS v4 6.0, while NVD assigned a CVSS v3.1 score of 9.1. NVD has not scored it under v4, so the two figures are not a like-for-like comparison. The Codex finding is the one with no version to install. Novee found that the openai/codex repository ran two Codex passes inside a single job sharing one checkout, so the first pass could write AGENTS.md, the file the second pass loads as its own instructions. Failing the JSON validation between the passes is what launched the second one. OpenAI's current workflow separates the passes into different jobs and runs Codex with drop-sudo and a read-only sandbox. OpenAI's guidance now lists repository instruction files among content that "should be considered part of the untrusted input surface," and recommends running Codex as the last step in a job, warning that it may otherwise leave files behind for privileged steps that follow. Neither change shows that Codex itself now handles a writable instruction file differently; what the sources establish is a repository-level workflow fix and a documentation update. CISA's entry on both the Gemini and Claude Code CVE records lists exploitation as none, and The Hacker News confirmed on August 7 that neither appears in the agency's Known Exploited Vulnerabilities catalog. It also found a public GitHub repository describing itself as a reproduction lab for the Claude Code flaw, up since June 18. Nothing in the sources reviewed shows either chain used against a target. The development comes as Pillar Security reported on August 4 that the operators of the ChainDrop npm worm planted a Claude Code SessionStart hook and a VS Code folderOpen task in compromised repositories, firing when a developer opened the workspace rather than waiting for an install. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Application Security, artificial intelligence, CI/CD Security, Cloud security, Command Injection, data exfiltration, DevSecOps, GitHub, Software Security, Vulnerability ⚡ Top Stories This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable ⭐ Featured Resources [Webinar] How Militaries Can Trust the Data Behind Autonomous Missions Download the 5-Step Action Plan for AI-Speed Exploitation Get the Checklist for Gaining Control of AI Use Across Your Organization Get the 2026 CISO Benchmark Report Based on 600 Security Leaders

Indicators of Compromise

• cve — CVE-2026-12537
• cve — CVE-2026-54316

Entities