CVE-2026-0755: gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)

The MCP server launches the Gemini CLI with the caller's prompt through execAsync. ZDI describes it as a user-supplied string used in a system call without validation. Two problems follow.

First, the Gemini CLI treats @path in a prompt as a file reference. A prompt containing @/etc/passwd, @~/.ssh/id_rsa or @../../secret makes the CLI load that file's contents into the request, so an attacker can read and exfiltrate local files.

Second, on Windows the arguments went through cmd.exe without proper quoting. The maintainers say an earlier shell:false double-quote wrapping was broken. Metacharacters could then break out of the argument and run OS commands.

The attacker needs only to get text into the prompt. That can be a direct MCP call, or an AI agent steered by a prompt injection in a web page or document. ZDI rates it CVSS 9.8 with no authentication and code execution as the service account. The advisory's own text confirms file read on all platforms and command injection on Windows. ZDI reported it in July 2025 and published it as a 0-day in January 2026.

npm package gemini-mcp-tool at 1.1.2 up to but not including 1.1.6. The command-injection path applies on Windows. The @file read applies wherever the Gemini CLI runs. Check:

npm ls -g gemini-mcp-tool

If you run it with npx, check the version in your MCP client config.

Upgrade to gemini-mcp-tool 1.1.6.

npm install -g [email protected]

Version 1.1.6 removes the broken shell:false double-quote wrapping, adds assertSafeFileReferences() to keep @file references inside the working directory, and hardens Windows cmd.exe argument quoting. The advisory lists no workaround. Until you upgrade, do not pass untrusted text into prompts sent to the tool, and restrict who can reach the MCP server.

Search MCP and agent logs for prompts to the Gemini tool that contain @ followed by a path such as @/etc/, @~/.ssh or @../. On Windows, look for cmd.exe child processes of the MCP server running anything other than the Gemini CLI, with &, | or ^ in the arguments. Check for unexpected reads of SSH keys or dotfiles by the Node process. Beam records agent shell commands, file access and MCP tool calls, and its rules flag risky ones, which would show a prompt-driven file read or command.

Untrusted prompt input could reach the Gemini CLI @file parser, allowing read/exfiltration of arbitrary local files (@/etc/passwd, @~/.ssh/id_rsa, @../../secret). On Windows, unquoted cmd.exe metacharacters could break out into OS command injection.

Fix (1.1.6): removed the broken shell:false double-quote wrapping; added assertSafeFileReferences() to contain @file refs to the working directory; hardened Windows cmd.exe argument quoting.