What happened
A vulnerability in the Gemini CLI and associated GitHub Action allowed an unprivileged attacker to achieve an arbitrary code execution in Gemini CLI via untrusted local. CVE-2026-13745 currently carries a CRITICAL 9 2 severity signal in the retained vulnerability data. The reported consequence is code execution, meaning successful exploitation could make the affected application or process run attacker-controlled code.
The reported flaw is best understood as an code-execution weakness, rather than treating the CVE identifier or CVSS score as the whole story. Successful exploitation could let an attacker run code on a vulnerable system, which can lead to broader compromise depending on the privileges of the affected service.
Reference sources
Reporting ends here. The sections below are CyberDeltaForce analysis and defender-focused interpretation.
What security teams should do now
- Inventory the affected product deployments and confirm whether the affected component and vulnerable release are present.
- Apply the vendor patch or mitigation for CVE-2026-13745 and validate the affected path after remediation.
What is not yet confirmed
- So far, researchers have not reported exploitation, but that can change as vendor, government or threat-intelligence reporting develops.
