gemini-cli patches checkpoint path traversal letting tags delete or read files outside directory
princeraj2572 · ghdev · 2026-09-24
A P1 security PR in google-gemini/gemini-cli fixes a path traversal flaw in the checkpoint feature. The legacy fallback built paths with path.join(geminiDir, 'checkpoint-' + tag + '.') from raw tags; since path.join normalizes .., a tag like x/../../secret resolved outside the checkpoints directory, so deleteCheckpoint could unlink and loadCheckpoint could read arbitrary . files. The fix adds a legacyCheckpointPath() helper that only returns a path for a flat checkpoint-<tag>. file directly inside the gemini directory, rejecting tags with separators or .. (also blocking in-directory hits like x/../settings). Flat legacy tags behave as before. Two new tests fail pre-fix and pass post-fix (41/41).
More from coding & agent
- AI compliance startup CompAI hits 1,000+ paying business customers in under a year — JosephJacks_ · 2026-09-25
- Sleep Data for Personal AI? Separating Daily Signals from Hard Rules — sujingshen · 2026-09-25
- Markdown Is the New Source Code: How to Manage Runbooks, Prompts and Rules for Agents — arpit_bhayani · 2026-09-25
- The personal agent supercycle needs hard authorization boundaries, not autonomy — sujingshen · 2026-09-25
- Mnemos.Field nears launch: a virtual world where humans and AI agents both register and participate — RileyRalmuto · 2026-09-25
- SemIf open-sources a Jev-style interface: typed option probabilities from a 4B model, no JSON parsing — JeremyCMorgan · 2026-09-25