CVE-2026-13745: Google Cloud Gemini CLI

High severity, CVSS 7.7. EPSS: 0.4% chance of exploitation in the next 30 days.

A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into starting the CLI within an untrusted directory. The vulnerability is triggered via untrusted .env files overriding GEMINI_CLI_HOME to load malicious configuration files and bypass folder trust prompts.

Affected products

• Google Cloud Gemini CLI: before 0.39.1 (fixed in 0.39.1)

Published 2026-09-10. Last modified 2026-09-23.