Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets

Researchers at Novee Security identified critical vulnerabilities in Anthropic's Claude Code and Google's Gemini CLI that could allow unprivileged attackers to access CI workflow secrets or execute code on CI runners. CVE-2026-12537 in Gemini CLI enables OS command injection via a malicious .gemini/.env file, allowing pre-sandbox code execution on CI hosts. CVE-2026-54316 in Claude Code allows exfiltration of API keys one character at a time through Hugging Face's public download counter. Both vulnerabilities have been patched, with no evidence of active exploitation in the wild. The root cause across both systems was flawed 'harness' code that failed to properly validate or sandbox model-generated commands.

AI-extracted · verify before operational use