Google Gemini CLI patch blocks $VAR and ${VAR} shell-expansion bypass
thalha-a9 · ghdev · 2026-07-15
A Google Gemini CLI pull request fixes a shell-safety bypass that let $VAR and ${VAR} expansion slip past the security gate.
- The patch hardens both Bash and PowerShell detection in detectBashSubstitution() and detectPowerShellSubstitution().
- It adds a safe allowlist for automatic variables, expands test coverage to 120 cases, and tightens the GitHub workflow by clearing GITHUBTOKEN in the sandboxed environment.
- The PR reports green CI, passing pre-commit hooks, and a single verified call site with no unintended side effects.
More from coding & agent
- SF 'Code Engineering' event picks up where 1,000-person harness engineering meetup left off — LangChain · 2026-10-27
- Prompt turns Claude Code into an iPhone backup forensics tool exposing 30-day 'deleted' photo copies — alex_verem · 2026-10-27
- Prompt turns Claude Code into a forensics tool finding deleted iPhone photos in backups — alex_verem · 2026-10-27
- Phones won't be mobile IDEs but control planes for agent fleets, argues Yuchen Jin — Yuchenj_UW · 2026-10-27
- Agent Field Kit launches $29 security runbooks for production AI agents — alvelda · 2026-10-27
- Cloudflare Durable Objects validated as top architecture for AI agent WebSocket servers — tristanbob · 2026-10-27