Gemini CLI glob tool could list /etc/passwd via absolute patterns, PR adds containment
ManoharPaturi · ghdev · 2026-09-27
Another gemini-cli security PR fixes a path-escape bug in GlobTool: execute validates dirpath via resolveToRealPath + validatePathAccess, but passed the raw pattern to the glob library. On glob 12, absolute patterns resolve against the filesystem root and ignore cwd, so /etc/.conf — or {/etc/passwd,fileA.txt} smuggled through brace expansion — lists files outside the workspace, bypassing access validation; Windows drive roots behave the same. The author reproduced it on main, and notes the ../ escape reported in #29075 does not reproduce on glob 12.
The fix is defense in depth:
- isAbsolutePattern rejects POSIX-absolute and Windows drive-root patterns up front with INVALIDTOOLPARAMS.
- Glob results are re-filtered to paths still resolving inside each search directory, dropping any escapes (braces, backslashes, or future glob behavior changes) with a debug warning.
Glob suite passes 41/41 with the fix.
More from coding & agent
- The Vanishing Apprentice: How AI Is Reshaping the Junior Developer Role — ArtificialOther · 2026-09-28
- Higgsfield ships 11 production skills that leave Claude with editable project files — xiaohu · 2026-09-28
- AI-generated 7-minute SQLite repo explainer stuns with coherent code walkthrough — deedydas · 2026-09-28
- Is Agentic scores how AI-agent-ready your website is, via a single npx command — seanwbren · 2026-09-28
- SolidBot moves real steel: post-processed robot programs now heading into TCP and accuracy tests — MatthewChang · 2026-09-28
- Grok Bot and Muse too dumb for business agents, says engineer comparing Claude Code — jdjohnson · 2026-09-28