Gemini CLI patch closes an SSRF bug by adding async DNS checks before fetch

deepresearcher08 · ghdev · 2026-07-29

Gemini CLI fixes an SSRF hole in web-fetch.ts by switching to async DNS validation

A pull request in google-gemini/gemini-cli fixes an SSRF vulnerability in web-fetch.ts.

The bug came from isBlockedHost() calling a synchronous isPrivateIp() check.
That check only handled literal IPs, so a hostname that resolved to something like 169.254.169.254 could bypass validation.
The fix makes isBlockedHost() async and uses isPrivateIpAsync() so DNS resolution happens before the safety check.
Related call sites were updated to await the check in both the primary and fallback fetch paths.
The reporter also notes a remaining TOCTOU / DNS rebinding risk and suggests follow-up hardening:
pin the connection to the validated IP
validate all resolved addresses
broaden private-range coverage
disable automatic redirects or re-check every hop

More from coding & agent