Gemini CLI patch blocks zero-click RCE in untrusted workspaces
luisfelipe-alt · ghdev · 2026-07-21
A Google Gemini CLI PR hardens a2a-server against zero-click RCE and environment poisoning in untrusted workspaces.
The patch changes startup and config loading so workspace .env files are ignored until trust is verified, and it isolates per-task environment state using AsyncLocalStorage plus a Proxy around process.env.
Key changes:
- defer environment loading until after workspace trust checks
- ignore workspace .env and .gemini/.env when the workspace is untrusted
- only load trusted home-directory env files in that case
- isolate task-level env and directory behavior to reduce cross-task leakage
More from coding & agent
- Spring AI 2.1.0-RC1 adds tool-call confirmation, pausing agent loops before real-data access — therealdanvega · 2026-10-26
- 250 Builders Hack With Codex at Berlin Community Hackathon Ahead of OpenAI DevDay — paw_lean · 2026-10-26
- Building AI bots on raw APIs? Devs say models are 'dumb without the harness' — madeofAjala · 2026-10-26
- HarnessMM cuts agent tokens per task by up to 88% while raising success rates — omarsar0 · 2026-10-26
- Microsoft demos intent-classifying agents built with Copilot App and Foundry, deployable across Teams and Outlook — marlene_zw · 2026-10-26
- Looking for a wearable mic with best battery life that feeds recordings to personal agents via MCP — altryne · 2026-10-26