Full research report
Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets
Executive assessment
The strongest evidence supports two distinct vulnerabilities exposed by CI workflows that accepted public repository content while retaining privileged capabilities. Gemini's CVE crosses the isolation boundary before sandboxing through trusted workspace environment handling, while Claude Code's CVE abuses an overly broad WebFetch hostname permission as a low-bandwidth disclosure channel. Vendor advisories and NVD agree on the affected products and fixed versions, although Google's advisory covers additional trust and allowlisting hardening beyond the narrower CVE description. Public technical material, including a Claude Code reproduction lab, raises reproducibility but does not establish malicious exploitation.
What happened
Novee Security disclosed security-boundary failures affecting coding automation from Anthropic, Google and OpenAI at Black Hat USA on 5 August 2026, followed by its written research on 6 August. The two assigned vulnerabilities are CVE-2026-12537 in Gemini CLI and run-gemini-cli, which can permit host-level execution before sandboxing, and CVE-2026-54316 in Claude Code, which can expose accessible data through a pre-approved Hugging Face WebFetch route. Both assigned vulnerabilities had fixes available when the story was published on 7 August.
Affected scope
CVE-2026-12537 affects Gemini CLI releases before 0.39.1, preview releases before 0.40.0-preview.3, and run-gemini-cli before 0.1.22 when used on headless CI platforms with untrusted workspace content. CVE-2026-54316 affects @anthropic-ai/claude-code versions 0.2.54 through 2.1.162 where an attacker can place untrusted content in the Claude Code context and Claude can access sensitive files, environment variables or command output. Externally triggered issue-triage and pull-request workflows carrying repository or service credentials present the clearest operational exposure.
Technical assessment
For CVE-2026-12537, vulnerable headless execution could automatically trust workspace configuration and process malicious environment-variable content before the intended sandbox boundary; the associated Google update also enforces fine-grained tool restrictions under unattended approval mode. For CVE-2026-54316, Claude Code pre-approved huggingface.co without restricting the permitted path, allowing requests to attacker-controlled Hugging Face repositories; publicly observable download activity could then encode data accessible to Claude. The weaknesses affect separate trust boundaries and should not be treated as one interchangeable exploit chain.
Recommended defensive actions
- Update Gemini CLI to 0.39.1 or 0.40.0-preview.3 and run-gemini-cli to 0.1.22 or later.
- Update Claude Code to 2.1.163 or later and verify that no older executable remains on developer systems or CI runners.
- Audit workflows triggered by public issues, pull requests, comments or repository files, and prevent untrusted content from reaching credential-bearing execution contexts.
- Restrict GitHub tokens and service credentials to the minimum permissions and lifetime required by each workflow.
- Configure outbound network controls for CI runners and monitor unexpected Hugging Face repository requests or unusual repeated download activity.
- Investigate historical workflow runs for untrusted .gemini configuration, unexpected pre-sandbox execution, secret-access events and anomalous repository changes.
- Rotate credentials where review indicates that a vulnerable workflow processed attacker-controlled content while sensitive values were available.
Uncertainties and evidence gaps
- No reviewed vendor, government or independent source establishes real-world exploitation of either assigned CVE.
- The number of third-party repositories that ran the vulnerable defaults has not been independently verified.
- Google's advisory combines workspace-trust and tool-allowlisting changes, whereas the CVE record specifically describes command injection through malicious .gemini/.env content in the container launcher.
- Separate Claude Code command-validation and OpenAI Codex workflow findings discussed by Novee have no confirmed CVE or publicly stated product-level fixed version in the reviewed material.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
No confirmed active exploitation; a public reproduction lab exists for CVE-2026-54316, and detailed research is public for both vulnerabilities.
The investigation began by separating the two assigned vulnerabilities from the broader three-vendor research presentation. Vendor advisories and National Vulnerability Database records confirmed the affected versions, prerequisites, mechanisms and fixes, while Novee's account established how public GitHub content could cross CI trust boundaries. A GitHub search also confirmed that reproduction material exists for the Claude Code issue, but the reviewed sources provide no evidence of attacks against real targets.
- What exactly was disclosed, and which claims required primary verification?Reviewed the supplied article and separated the Gemini and Claude Code CVEs from the additional unassigned Claude Code and Codex findings.thehackernews.com ↗
The article reports an August 2026 Black Hat disclosure, two patched CVEs, an unassigned Codex workflow issue and no known attacks against targets.
why This established the event boundary and prevented unrelated findings from being represented as part of either CVE.
- Did the original researchers demonstrate reachable security impact from unprivileged GitHub content?Read Novee Security's original disclosure and its accounts of testing vendor-owned repositories using shipped workflow defaults.novee.security ↗
Novee reports that public issue content reached automated runs and demonstrated execution, credential exposure and cross-run instruction persistence under different products.
why The original research supports technical feasibility, while remaining distinct from evidence of malicious exploitation in the wild.
- Which Gemini versions and operating conditions are affected, and what changed?Reviewed Google's security advisory for Gemini CLI and run-gemini-cli.github.com ↗
Google lists Gemini CLI versions before 0.39.1 and run-gemini-cli versions before 0.1.22 as affected, with a preview fix in 0.40.0-preview.3; it also requires explicit trust in headless use and enforces tool restrictions during unattended approval.
why This supplied authoritative remediation and showed that headless workflows processing untrusted folders are the relevant deployment class.
- Does an independent government record connect CVE-2026-12537 to the reported Gemini issue?Opened the National Vulnerability Database record for CVE-2026-12537.nvd.nist.gov ↗
NVD identifies command injection in the Gemini container launcher through malicious .gemini/.env content, enabling pre-sandbox host-level execution on headless CI platforms; it confirms the same fixed versions.
why This independently corroborated the CVE-to-product mapping and narrowed the CVE mechanism relative to Google's broader advisory.
- Which Claude Code versions are affected and what fix is available?Reviewed Anthropic's GitHub security advisory.github.com ↗
Anthropic marks versions from 0.2.54 up to but excluding 2.1.163 as affected and identifies 2.1.163 as patched, with a Moderate CVSS v4 score of 6.0.
why This provided authoritative version boundaries and avoided treating NVD's different CVSS version as a direct scoring contradiction.
- What prerequisite and exfiltration mechanism does CVE-2026-54316 actually require?Opened the National Vulnerability Database record for CVE-2026-54316.nvd.nist.gov ↗
The record says huggingface.co was pre-approved as a bare hostname, allowing attacker-controlled repository paths to be fetched; download activity could encode files, environment variables or command output, provided untrusted content reached the Claude Code context.
why This confirms that exploitation is conditional and confidentiality-focused rather than automatic execution merely from installing Claude Code.
- Is public reproduction material available for the Claude Code vulnerability?Searched GitHub repositories for CVE-2026-54316.github.com ↗
The search returned one repository described as a reproduction lab for the WebFetch and Hugging Face behaviour.
why This established public proof-of-concept availability without implying that the vulnerability has been used maliciously.
- Does the repository contain substantive reproduction material rather than only a CVE mention?Opened and reviewed the reproduction repository and its documented lab structure.
The repository contains a README, container definition, fixtures, scripts and demonstration payload material specifically labelled for CVE-2026-54316.
why This supports classifying a public reproduction as available, while the absence of attack reporting means active exploitation remains unconfirmed.
Research coverage
All 68 registered source leaves were evaluated for this run: 60 completed, 0 were unavailable, 1 failed and 7 were disabled. For this story, 3 registered sources supplied useful evidence (2 primary, 0 corroborating, 1 contextual and 0 PoC/exploit references). 57 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| NVDcve | ok900 records | Primary evidence2 matched items | Supplied a vendor or government advisory opened and verified during focused research. |
| The Hacker Newsnews | ok12 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| FIRST EPSSepss | ok7541 records | Context2 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| BleepingComputernews | ok5 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CISA Alertsnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| CISA KEVkev | ok1662 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5322 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok676 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1008 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok13 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok17 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok18 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok5 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1588 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 8 opened outside the registered collection
Vulnerability & exploitation2
Vendor & gov advisories4
Google identifies affected headless use, the workspace-trust and allowlisting changes, and fixed releases.
Confirms the pre-sandbox command-injection issue, affected components and fixed versions.
Anthropic confirms Claude Code versions 0.2.54 through 2.1.162 are affected and 2.1.163 is fixed.
Confirms the permissive WebFetch hostname rule, required untrusted context and potential disclosure of accessible data.
Analysis & research2
Original researcher account covering the tested workflows, trust-boundary failures and vendor responses.
Independent reporting that distinguishes the two CVEs from separate unassigned Claude Code and Codex findings.