Skip to content
Submit incident
AII-1001-57767
ReportedReported by fewer than three independent publishers, with no official finding.

Google Gemini CLI vulnerable to remote code execution via MCP configuration

Mindgard AI disclosed a remote code execution vulnerability in Google's Gemini CLI that allows attackers to execute arbitrary code through malicious Model Context Protocol server configurations in workspace settings.

22 December 2025 · Google · Security and cyberattacks
22 December 2025

Drafted by Raidu Incident Detection, an automated system.

AII-1001-57767View source ↗
Quick facts
Category
Security and cyberattacks
Country
United States
Source
mindgard.ai
Date
22 December 2025
Drafted by
Raidu Incident Detection

What happened

The gemini-cli is vulnerable to Arbitrary Code Execution (RCE) via malicious Model Context Protocol (MCP) server definitions in workspace settings. Workspace settings can configure MCP servers through the mcpServers or mcp.serverCommand fields in .gemini/settings.json.

Classification

Category
Security and cyberattacks
Industry
IT infrastructure and hosting
Country
United States
Harm status
Potential harm
Intent
Unintentional
Timing
Post-deployment
Failure modes
Unsafe autonomous behaviour
Consequences
None recorded
AI systems
Gemini CLI

Sources and evidence

This record was researched and written by the Index, based on the following original reporting.

mindgard.ai
Mindgard Disclosure