gemini-cli patches checkpoint path traversal letting tags delete or read files outside directory
princeraj2572 · ghdev · 2026-09-24
A P1 security PR in google-gemini/gemini-cli fixes a path traversal flaw in the checkpoint feature. The legacy fallback built paths with path.join(geminiDir, 'checkpoint-' + tag + '.') from raw tags; since path.join normalizes .., a tag like x/../../secret resolved outside the checkpoints directory, so deleteCheckpoint could unlink and loadCheckpoint could read arbitrary . files. The fix adds a legacyCheckpointPath() helper that only returns a path for a flat checkpoint-<tag>. file directly inside the gemini directory, rejecting tags with separators or .. (also blocking in-directory hits like x/../settings). Flat legacy tags behave as before. Two new tests fail pre-fix and pass post-fix (41/41).
More from coding & agent
- Why inference speed will be AI products' biggest competitive edge in 1–2 years — itsOmSarraf_ · 2026-11-11
- What happened when I moved vector retrieval into Snowflake SQL instead of orchestrating RAG outside — dima806_dima · 2026-11-11
- OpenAI engineer runs Codex for 26 days straight hunting Atlantis, spawning "vibe archaeology" — Polymarket · 2026-11-11
- He replaced a $5,000/month ghostwriter with 11 Claude Skills and earned $47,000 from one post — aryanXmahajan · 2026-11-11
- Refero Styles ships 2,000+ DESIGN.md files to give Claude Code real design taste — bbssppllvv · 2026-11-11
- Agent circuit breaker: openclaw shorts bot halts itself after 3 failed experiments — Rich_Standard_1724 · 2026-11-11