Skip to content
Submit incident
AII-1001-57747
ReportedReported by fewer than three independent publishers, with no official finding.Supporting sources are pending verification.

Google Gemini CLI arbitrary code execution via malicious MCP server

A vulnerability was discovered in Google's Gemini CLI tool that allows arbitrary code execution through malicious Model Context Protocol server definitions in workspace configuration files. The vulnerability was discovered on December 22, 2025 and disclosed to Google on December 26, 2025.

22 December 2025 · Google · Security and cyberattacks
22 December 2025

Drafted by Raidu Incident Detection, an automated system.

AII-1001-57747
Quick facts
Organization
Google (subject)
Category
Security and cyberattacks
Country
United States
Date
22 December 2025
Drafted by
Raidu Incident Detection

What happened

The gemini-cli tool is vulnerable to arbitrary code execution through malicious Model Context Protocol (MCP) server definitions configured in workspace settings.

Attackers can exploit the mcpServers or mcp.serverCommand fields in .gemini/settings.json to execute code.

Classification

Organization
Google (subject)
Category
Security and cyberattacks
Country
United States
Harm status
Potential harm
Intent
Unknown
Timing
Post-deployment
Consequences
None recorded
AI systems
Gemini CLI

Sources and evidence

Sources not yet published

This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.

How sources are verifiedSuggest a source for this incident