Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-13745
Google Cloud Gemini CLI — Arbitrary Code Execution in Gemini CLI via Untrusted Local .env Files Overriding GEMINI_CLI_HOME
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV
N L P N P H H H 7.7 .0037 29.1 —
AFFECTED
Product Versions Fixed
Gemini CLI unspecified —
TIMELINE
Jun 29 Reserved by GoogleCloud
Sep 10 Published (CNA: GoogleCloud)
Sep 23 RESCORED — CVE-2026-13745 (Google Cloud Gemini CLI). CVSS 9.2 → 7.7 (NVD).
Description
A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into starting the CLI within an untrusted directory. The vulnerability is triggered via untrusted .env files overriding GEMINI_CLI_HOME to load malicious configuration files and bypass folder trust prompts.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| June 29, 2026 | Reserved | Reserved by GoogleCloud |
| September 10, 2026 | Published | Published (CNA: GoogleCloud) |
| September 23, 2026 | RESCORED | RESCORED — CVE-2026-13745 (Google Cloud Gemini CLI). CVSS 9.2 → 7.7 (NVD). |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Google Cloud | Gemini CLI | — | — | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-13745 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
