Gemini CLI path guard flaw: prefix check lets sibling dirs bypass docs sandbox
ranjan-del · ghdev · 2026-09-09
A P1 PR against google-gemini/gemini-cli fixes a path traversal bypass in the getinternaldocs tool: its guard used a string startsWith check on the resolved path, so a request like ../docs-private/secret.md still shared the <repo>/docs prefix and passed, letting the tool read sibling directories' files and return them to the model.
The fix swaps in the repo's existing isSubpath() helper, which uses path.relative() for component-boundary-aware comparison and handles case-insensitive filesystems on Windows/macOS. The original test only exercised ../package., which never shared the prefix, so the sibling-prefix case was never covered; the new test creates a real sibling directory and asserts denial. The tool is read-only, limiting severity.
More from coding & agent
- OpenAI opens up agent sandboxes: BYO or pick from Cloudflare, E2B, Modal, Vercel and more — threepointone · 2026-09-11
- SocialCrawl MCP lets agents search Reddit, YouTube, TikTok, X with one API key — dooddyman · 2026-09-11
- Astra builds a surprisingly polished Catan game in three.js, reusing past UI and 3D assets — FinanceYF5 · 2026-09-11
- Open-Source Tool Highlights the Exact PDF Paragraphs Behind AI Answers — Flat-Phone-1596 · 2026-09-11
- OpenAI Codex may issue another usage reset this weekend, says Codex lead resets happen — umesh_ai · 2026-09-11
- Dev swaps gemini-3.8 for gemini-3.5-flash-lite in his MCP harness at a fraction of cost — julianharris · 2026-09-11