# Critical Vulnerabilities in Claude Code and Gemini CLI Expose CI Workflow Secrets

*Published August 10, 2026*
*Source: [https://thehackernews.com/2026/08/claude-code-and-gemini-cli-flaws-let.html](https://thehackernews.com/2026/08/claude-code-and-gemini-cli-flaws-let.html)*

## Executive Summary

Critical vulnerabilities in Anthropic's Claude Code and Google's Gemini CLI allowed unauthorized code execution on CI runners through GitHub issues. Both vulnerabilities have been patched, though they highlight significant security concerns in CI workflows.

## Article

A significant security flaw was discovered in both Anthropic's Claude Code and Google's Gemini CLI, allowing unauthorized code execution on continuous integration (CI) runners through a GitHub issue. This vulnerability was identified and presented by Novee Security at the Black Hat USA conference on August 5. Two critical vulnerabilities were assigned CVEs and have since been patched. The most severe of these is CVE-2026-12537, which scored a perfect 10.0 on the CVSS scale. This flaw in Gemini CLI allowed OS command injection via a specially crafted file, enabling attackers to run code on the CI platform before the sandbox environment was initiated. The vulnerability has been fixed in Gemini CLI version 0.39.1 and run-gemini-cli version 0.1.22.

In Claude Code, CVE-2026-54316 exposed an API key via Hugging Face's download counter, leaking it one character at a time. This issue affects all releases from version 0.2.54 to 2.1.163 and has been resolved in version 2.1.163. Exploitation of this vulnerability required untrusted content to be introduced into the Claude Code context.

Notably, a similar flaw was found in OpenAI's Codex, yet it did not result in a CVE or a specific product version patch. OpenAI claims their sandbox behaved as intended according to their documentation. Security teams are advised to update their systems to the latest patched versions and thoroughly audit any workflows accessible by external users.

While Gemini's vulnerability did not involve model manipulation, the root of the issue across all platforms lay in the harness—the intermediary code dictating what the model executes. Novee Security highlighted that Claude Code's command validator erroneously processed single-quoted text, leading to potential exploits, though this did not result in a CVE or a public fix. Additionally, Gemini CLI's tool allowlist, which was only parsed during registration, allowed unauthorized command execution at runtime. Google has addressed this alongside the container-launcher flaw in a security advisory.

Currently, there is no evidence of these vulnerabilities being exploited in the wild. However, Pillar Security has reported recent malicious activity involving Claude Code in the ChainDrop npm worm, demonstrating the ongoing risks posed by such vulnerabilities.