Skip to content

Back to the catalog

Claude Code & Gemini CLI: GitHub Issue → CI Secrets
thehackernews.comwriteup

Claude Code & Gemini CLI: GitHub Issue → CI Secrets

Novee Security disclosed that a low-privilege GitHub issue could trigger code execution on CI runners for Gemini CLI and Claude Code, and hijack the next agent run in OpenAI Codex, via flaws in the "harness" code surrounding each coding agent rather than the LLM itself. CVE-2026-12537 is a CVSS 10.0 OS command injection in Gemini CLI's container launcher via a crafted .gemini/.env file (fixed in 0.39.1); CVE-2026-54316 abused Hugging Face's public download counter as a side channel to exfiltrate a Claude Code API key one character at a time (fixed in 2.1.163). A separate Claude Code bash-quoting validator bypass and a Codex AGENTS.md instruction-file poisoning issue (via shared checkout across two passes) had no CVE, prompting OpenAI to only issue workflow/documentation fixes.

TL;DR Black Hat research shows unprivileged GitHub issues can hijack CI runs of Claude Code, Gemini CLI, and Codex via harness flaws, not model flaws — two CVEs, one unfixed bash-quoting bypass, one Codex workflow fix.
Open original ↗
Document

What it is

Novee Security's Black Hat USA (Aug 5, 2026) disclosure of "harness"-level flaws in three shipped coding-agent CI configurations. Two CVEs, both patched: CVE-2026-12537 (CVSS v4 10.0), an OS command injection in Gemini CLI's container launcher; and CVE-2026-54316 in Claude Code, which leaked an API key via a Hugging Face download-counter side channel. A Claude Code command-validator bypass and a Codex AGENTS.md poisoning issue got no CVE.

How it works

The recurring pattern: one part of the harness marks a value safe, a later part acts on it with more authority.

  • Gemini CLI: a crafted .gemini/.env reaches the container launcher and runs on the CI host before the sandbox starts — no model persuasion needed. Separately, the tool allowlist was parsed only at registration; nothing enforced it at runtime, and --yolo auto-approved every command.
  • Claude Code validator (no CVE): the validator strips single-quoted text before its 23 checks (correct bash behavior), so a payload in the value of git push --receive-pack reached the runner untouched.
  • Codex (no CVE): two Codex passes shared one checkout in a single job; the first could write AGENTS.md, which the second loads as instructions. Failing JSON validation between passes is what launched the second.

Preconditions / Affected

  • Vendors' default-shipped CI configs; a GitHub issue from an account with no repo privileges was sufficient.
  • Claude Code CVE affects every release 0.2.54 → 2.1.163; Anthropic says exploitation required getting untrusted content into a Claude Code context.
  • Gemini bug hits headless CI platforms.

What to do

Update, then audit any workflow an outside user can trigger:

  • Gemini CLI → 0.39.1; run-gemini-cli → 0.1.22
  • Claude Code → 2.1.163

For Codex there is no version to install. OpenAI's fixed workflow splits the passes into separate jobs and runs Codex with drop-sudo and a read-only sandbox; its guidance now treats repository instruction files as untrusted input and recommends running Codex as the last step in a job (it may otherwise leave files for privileged steps that follow).

Caveats

  • Scoring is inconsistent for the Claude Code flaw: Anthropic rates it Moderate, CVSS v4 6.0; NVD assigned CVSS v3.1 9.1 and has not scored it under v4, so the figures aren't comparable.
  • The Gemini advisory itself shows no CVE; Google Cloud published the identifier separately as CNA.
  • CISA lists exploitation as none for both CVEs; neither is in the KEV catalog (confirmed Aug 7). A public reproduction lab for the Claude Code flaw has existed since June 18, but no source shows either chain used against a target.

Organisations named here

  • Elad Meged
  • Novee Security

CVEs named here

  • CVE-2026-12537
  • CVE-2026-54316

Technologies named here

  • Gemini CLI
  • run-gemini-cli
  • Claude Code
  • Codex
  • Novee Security
  • Gemini CLI GitHub Actions
  • Pillar Security
  • CISA Known Exploited Vulnerabilities Catalog
  • NVD
  • GitHub Actions
  • Hugging Face
  • npm

Techniques named here

  • OS command injection via crafted .env file
  • Covert exfiltration via public metric channel
  • Input-validation bypass via quote stripping
  • Tool allowlist runtime bypass
  • Instruction-file poisoning across shared checkout
  • Workspace-open triggered hook abuse

Threat actors named here

  • Novee Security
  • ChainDrop npm worm
  • ChainDrop

Related in DevSecOps