Gemini CLI path traversal bug: crafted tag could delete files outside checkpoint dir
ManoharPaturi · ghdev · 2026-09-27
A PR (#29521) for google-gemini/gemini-cli fixes a path traversal vulnerability: getCheckpointPath and deleteCheckpoint built the legacy fallback path using the raw tag, and path.join normalizes .. segments away. A tag like x/../../secret could resolve to a file outside the checkpoint directory — /chat delete <tag> would unlink it, and checkpoint load would return its contents.
Fix: a new isInsideCheckpointDir helper ensures the legacy raw path is only used when it still resolves inside the checkpoint directory (path.resolve + prefix check), so traversal tags simply miss with normal ENOENT semantics. Applied at both legacy uses: the load/exists fallback and the backward-compat unlink. Flat legacy tags behave exactly as before. Same bug class as #28699 (a2a-server restore path); closes #29191. Regression tests included; logger suite passes 43/43.
More from coding & agent
- Open-source git-story-film Skill Turns Your Git History Into a Short Film — dotey · 2026-09-27
- Rust-style constrained languages suit LLMs; agent-targeted DSLs are coming — burny_tech · 2026-09-27
- Agent developer seeks failover patterns after single-provider outage killed every run — Arkupathak · 2026-09-27
- Dev building a compiler since February: Codex failed, Claude is the only AI that works — QuixiAI · 2026-09-27
- Parents Independently Use Claude Code to Build Custom Educational Games for Their Kids — minilek · 2026-09-27
- Gemini CLI PR fixes checker env leak: third-party checkers once saw GEMINI_API_KEY — ManoharPaturi · 2026-09-27