Answer in brief
CVE-2026-54785 records a Medium severity tool poisoning vulnerability in gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
Answer in brief
CVE-2026-54785 records a Medium severity tool poisoning vulnerability in gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
Update gemini-bridge to 1.3.1 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanTool Poisoning describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-54785 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| gemini-bridgepip | >=1.0.0,<1.3.1 | 1.3.1 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-54785 records a Medium severity tool poisoning vulnerability in gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for gemini-bridge.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate gemini-bridge to 1.3.1 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanTool Poisoning describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-54785 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| gemini-bridgepip | >=1.0.0,<1.3.1 | 1.3.1 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-54785 records a Medium severity tool poisoning vulnerability in gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for gemini-bridge.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard### Summary `consult_gemini_with_files` in **inline mode** read any file path supplied in the `files` argument without confining it to the working `directory`, then forwarded the contents to the Gemini CLI. Because the caller also controls `query`, the file contents are echoed back through the Gemini round-trip (and sent to Google), making this an arbitrary local file read. ### Impact An MCP client — or an LLM that has been prompt-injected into calling the tool — can read **any file the server process can access** (SSH keys, cloud credentials, `.env`, source) and have it disclosed via the tool response. No code execution by itself. ### Affected component - Tool: `consult_gemini_with_files(query, directory, files, …)`, `mode="inline"` - Sink: `_read_file_for_inline` via `_prepare_inline_payload` in `src/mcp_server.py` - The `at_command` mode already confined paths; inline mode did not. ### Root cause `_resolve_path` returned an out-of-root path while only nullifying the *display* name, and `_prepare_inline_payload` read the file regardless. Absolute paths, `..` traversal, and symlink escapes were all accepted. ### Patch Fixed in **1.3.1**. `_resolve_path` now resolves symlinks and confines via `Path.relative_to(root)`; inline mode skips any entry that resolves outside the working directory (the same guard `at_command` already enforced). ### Workarounds Upgrade to 1.3.1. Before upgrading, avoid `mode="inline"` with untrusted `files` input, or run the server with a restricted-permission user. ### Credit Reported privately by Zhihao Zhang (WPI).
### Summary `consult_gemini_with_files` in **inline mode** read any file path supplied in the `files` argument without confining it to the working `directory`, then forwarded the contents to the Gemini CLI. Because the caller also controls `query`, the file contents are echoed back through the Gemini round-trip (and sent to Google), making this an arbitrary local file read. ### Impact An MCP client — or an LLM that has been prompt-injected into calling the tool — can read **any file the server process can access** (SSH keys, cloud credentials, `.env`, source) and have it disclosed via the tool response. No code execution by itself. ### Affected component - Tool: `consult_gemini_with_files(query, directory, files, …)`, `mode="inline"` - Sink: `_read_file_for_inline` via `_prepare_inline_payload` in `src/mcp_server.py` - The `at_command` mode already confined paths; inline mode did not. ### Root cause `_resolve_path` returned an out-of-root path while only nullifying the *display* name, and `_prepare_inline_payload` read the file regardless. Absolute paths, `..` traversal, and symlink escapes were all accepted. ### Patch Fixed in **1.3.1**. `_resolve_path` now resolves symlinks and confines via `Path.relative_to(root)`; inline mode skips any entry that resolves outside the working directory (the same guard `at_command` already enforced). ### Workarounds Upgrade to 1.3.1. Before upgrading, avoid `mode="inline"` with untrusted `files` input, or run the server with a restricted-permission user. ### Credit Reported privately by Zhihao Zhang (WPI).