Google Fixes CVSS 10 Gemini CLI CI RCE and Cursor Flaws Enable Code Execution

Google disclosed critical RCE vulnerabilities in Gemini CLI and Cursor that pose supply-chain risks.

• •Gemini CLI (CVSS 10.0): attackers execute commands via malicious configuration in headless CI mode without folder trust
• •Cursor (CVE-2026-26268, CVSS 8.1): sandbox escape via Git hooks in bare repositories triggered during git checkout
• •Cursor (CVSS 8.2): installed extensions access API keys and credentials from SQLite without access control
• •Mitigation: enable GEMINI_TRUST_WORKSPACE, use tool allowlisting, install only trusted extensions

This summary was automatically generated by AI based on the original article and may not be fully accurate.