An allowlisted command hides a chained payload
Tracebit showed Gemini CLI would run a grep it treated as allowlisted, with a hidden command after it that sent the user's environment variables to a remote server.
- Agents
- Gemini CLI
- Reported
- Source checked
- Tags
- allowlist, shell, context-files
Symptom
You allowlisted grep once. Later, while the agent seems to just describe the codebase, your environment variables (and any secrets in them) are sent to a remote server, and the terminal shows nothing unusual.
Cause
Gemini CLI treated the whole shell string as the allowlisted grep command. A prompt injection in a README or context file appended an exfiltration command, and padding it with whitespace hid it from the display.
Fix
Upgrade Gemini CLI to 0.1.14 or later. Allowlist exact commands, not prefixes, and run untrusted repos in a sandbox.
# Treat any of these in an "allowed" command as a new command
case "$CMD" in
*';'*|*'&&'*|*'||'*|*'|'*|*'$('*|*'`'*) echo 'compound command: ask' ;;
esac