CVE-2026-54785: gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

In inline mode, consult_gemini_with_files(query, directory, files, ...) reads each path in the files argument. The helper _resolve_path returned a path outside the working directory and only blanked its display name. Then _prepare_inline_payload in src/mcp_server.py called _read_file_for_inline on it anyway. Absolute paths, .. traversal and symlink escapes were all accepted.

The contents go to the Gemini CLI as part of the prompt. Because the caller also sets query, the model can echo the file back, and the text is sent to Google as well. The result is an arbitrary file read with the permissions of the server process. There is no code execution by itself.

The attacker is either a malicious MCP client or content that prompt-injects the agent into calling the tool with a path like ~/.ssh/id_rsa. The score is local with no user interaction, with high confidentiality impact only. The at_command mode already confined paths; only inline mode did not.

gemini-bridge from 1.0.0 up to but not including 1.3.1, when the consult_gemini_with_files tool is used with mode="inline". Check the installed version:

pip show gemini-bridge

If you run it through uvx or a pinned MCP config, look at the version pinned there.

Upgrade to 1.3.1:

pip install --upgrade gemini-bridge==1.3.1

The patch makes _resolve_path resolve symlinks and confine paths with Path.relative_to(root). Inline mode now skips any entry that resolves outside the working directory, the same guard at_command already had.

Before upgrading, the advisory says to avoid mode="inline" with untrusted files input, or to run the server as a user with restricted permissions.

Review your agent's MCP tool-call history for consult_gemini_with_files calls with mode inline where files holds absolute paths, .. segments or symlinks pointing outside the project, such as ~/.ssh, ~/.aws or .env files. Check Gemini CLI logs for prompts containing key material. If such a call ran, rotate the exposed credentials. Beam records agent MCP tool calls and file access, and its rules can flag reads of sensitive paths like these.

Summary

consult_gemini_with_files in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip (and sent to Google), making this an arbitrary local file read.

Impact

An MCP client — or an LLM that has been prompt-injected into calling the tool — can read any file the server process can access (SSH keys, cloud credentials, .env, source) and have it disclosed via the tool response. No code execution by itself.

Affected component

• Tool: consult_gemini_with_files(query, directory, files, …), mode="inline"
• Sink: _read_file_for_inline via _prepare_inline_payload in src/mcp_server.py
• The at_command mode already confined paths; inline mode did not.

Root cause

_resolve_path returned an out-of-root path while only nullifying the *display* name, and _prepare_inline_payload read the file regardless. Absolute paths, .. traversal, and symlink escapes were all accepted.

Patch

Fixed in 1.3.1. _resolve_path now resolves symlinks and confines via Path.relative_to(root); inline mode skips any entry that resolves outside the working directory (the same guard at_command already enforced).

Workarounds

Upgrade to 1.3.1. Before upgrading, avoid mode="inline" with untrusted files input, or run the server with a restricted-permission user.

Credit

Reported privately by Zhihao Zhang (WPI).