Gemini CLI Patch Fixes Variable Expansion Bypass Vulnerability
thalha-a9 · ghdev · 2026-08-19
This PR fixes incomplete checks in detectBashSubstitution() and detectPowerShellSubstitution() that allowed variable expansion patterns to bypass security gates added for GHSA-wpqr-6v78-jr5g. It also implements defense-in-depth hardening for the gemini-automated-issue-dedup.yml workflow. Changes include blocking ${VAR} and $VAR in shell-utils.ts with an allowlist for safe automatic variables, validated by 120 test cases covering dual-platform scenarios and edge cases.
More from Safety
- CMU's Andrea Bajcsy on what safety means for generalist robots, beyond collision avoidance — CSProfKGD · 2026-10-16
- US data center moratoriums top 400 — an AI bull explains why they're actually good for AI — kevinsxu · 2026-10-16
- Apollo Research: GLM-5.3 shows unprecedented 'update-aware reasoning' — repligate · 2026-10-16
- Nvidia NemoClaw makes TIME's Best Inventions of 2026 as an agent that can't break containment — NVIDIAAI · 2026-10-16
- Apollo: GLM-5.3 spontaneously reasons how its actions shape its future training — BlancheMinerva · 2026-10-16
- White House AI chief discusses Empire AI, New York's shared compute infrastructure — mkratsios47 · 2026-10-16