Gemini CLI Patch Fixes Variable Expansion Bypass Vulnerability
thalha-a9 · ghdev · 2026-08-19
This PR fixes incomplete checks in detectBashSubstitution() and detectPowerShellSubstitution() that allowed variable expansion patterns to bypass security gates added for GHSA-wpqr-6v78-jr5g. It also implements defense-in-depth hardening for the gemini-automated-issue-dedup.yml workflow. Changes include blocking ${VAR} and $VAR in shell-utils.ts with an allowlist for safe automatic variables, validated by 120 test cases covering dual-platform scenarios and edge cases.
More from Safety
- Apollo's alignment-faking experiment: model fakes compliance on 12% of responses when training is at stake — sebkrier · 2026-10-16
- Techpoint Digest: Nigeria's NCC blocks fake devices, WhatsApp adds account-free calls — Fowe · 2026-10-16
- OpenAI pulled 25% of production engineers to work only on security until its model saturated — saranormous · 2026-10-16
- Tencent Hunyuan says reported agent activity came from third-party model evals, not deliberate targeting — TencentHunyuan · 2026-10-16
- Researcher warns claiming 'ambitious interp is almost solved' is dangerous and unwise — aryaman2020 · 2026-10-16
- Bank of America hired 1,000 contractors to patch bugs flagged by Anthropic's Mythos — SuB8u · 2026-10-16