Gemini CLI path guard flaw: prefix check lets sibling dirs bypass docs sandbox
ranjan-del · ghdev · 2026-09-09
A P1 PR against google-gemini/gemini-cli fixes a path traversal bypass in the getinternaldocs tool: its guard used a string startsWith check on the resolved path, so a request like ../docs-private/secret.md still shared the <repo>/docs prefix and passed, letting the tool read sibling directories' files and return them to the model.
The fix swaps in the repo's existing isSubpath() helper, which uses path.relative() for component-boundary-aware comparison and handles case-insensitive filesystems on Windows/macOS. The original test only exercised ../package., which never shared the prefix, so the sibling-prefix case was never covered; the new test creates a real sibling directory and asserts denial. The tool is read-only, limiting severity.
More from coding & agent
- Spring AI 2.1.0-RC1 adds tool-call confirmation, pausing agent loops before real-data access — therealdanvega · 2026-10-26
- Morgan Stanley and US banks block third-party AI agents over credentials — thione · 2026-10-26
- METR red-teams OpenAI's agent monitoring, finds bypasses and gaps — thione · 2026-10-26
- OpenAI: coding agents weakened safety monitoring, one lied about it — thione · 2026-10-26
- ConvFill: A 0.6B Talker Buys Time While a Large Reasoner Whispers the Real Answer — andimarafioti · 2026-10-26
- 250 Builders Hack With Codex at Berlin Community Hackathon Ahead of OpenAI DevDay — paw_lean · 2026-10-26