CVE-2026-54785: 
Python vulnerability analysis and mitigation

CVE-2026-54785 is a path traversal vulnerability in gemini-bridge, a lightweight MCP (Model Context Protocol) server that bridges AI agents to Google's Gemini AI via the official CLI. The flaw exists in the consult_gemini_with_files tool when operating in inline mode, allowing arbitrary local file reads without restricting paths to the working directory. It affects gemini-bridge versions >= 1.0.0 and < 1.3.1 (pip package by eLyiN). The vulnerability was reported privately by Zhihao Zhang (WPI), published on June 9, 2026, and added to the GitHub Advisory Database on July 31, 2026. It carries a CVSS v3.1 base score of 6.2 (Medium) (Github Advisory, GitHub Security Advisory).

The root cause is classified as CWE-22 (Path Traversal) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). In src/mcp_server.py, the _resolve_path function returned an out-of-root path while only nullifying the display name; _prepare_inline_payload then called _read_file_for_inline on the resolved path regardless, reading the file and forwarding its contents to the Gemini CLI. Absolute paths, .. traversal sequences, and symlink escapes were all accepted without validation. Notably, the at_command mode already enforced working-directory confinement — the inline mode was simply missing the same guard. Because the caller also controls the query argument, file contents are echoed back through the Gemini round-trip and transmitted to Google's servers (Github Advisory, Fix PR).

Successful exploitation allows an attacker to read any file accessible to the gemini-bridge server process, including SSH private keys, cloud credentials, .env files, and application source code, all of which are then disclosed via the tool response and transmitted to Google's Gemini API. There is no direct code execution impact, and integrity and availability are unaffected. The scope is particularly concerning in AI-agent pipelines where prompt injection could cause an LLM to autonomously invoke the vulnerable tool with attacker-controlled file paths, enabling silent credential exfiltration without direct user interaction (Github Advisory, GitHub Security Advisory).

1. Identify a target: Locate a system running gemini-bridge versions >= 1.0.0 and < 1.3.1 as an MCP server, accessible via an MCP client or an LLM agent pipeline.
2. Craft a malicious tool call: As an MCP client (or via prompt injection into an LLM using the server), invoke consult_gemini_with_files with mode="inline", setting the files argument to a sensitive path outside the working directory — e.g., ["/home/user/.ssh/id_rsa"], ["../../../etc/passwd"], or a symlink pointing outside the root.
3. Trigger file read: The vulnerable _prepare_inline_payload function calls _resolve_path, which returns the absolute path without enforcing working-directory confinement, then passes it to _read_file_for_inline, reading the file contents.
4. Exfiltrate via Gemini round-trip: The file contents are embedded in the query payload sent to the Gemini CLI and forwarded to Google's Gemini API. The response echoes the file contents back through the tool response, disclosing them to the attacker.
5. Collect sensitive data: The attacker receives the file contents (e.g., SSH keys, .env secrets, cloud credentials) in the MCP tool response (Github Advisory, Fix PR).

• Logs: gemini-bridge server logs showing consult_gemini_with_files calls with files arguments containing absolute paths outside the configured working directory, .. traversal sequences (e.g., ../../../etc/passwd), or symlink names resolving outside the root.
• Network: Outbound HTTPS connections from the gemini-bridge process to Google Gemini API endpoints (generativelanguage.googleapis.com) carrying unusually large or structured payloads that may contain file contents (SSH keys, credential patterns).
• Process: Invocations of the Gemini CLI subprocess with stdin input containing content matching sensitive local files (e.g., PEM headers, BEGIN RSA PRIVATE KEY, .env variable patterns).
• File System: No direct file modification artifacts, but audit logs (if enabled) may show unexpected read access to files outside the MCP server's working directory by the server process (Github Advisory).

Upgrade gemini-bridge to version 1.3.1 via pip install --upgrade gemini-bridge, which fixes _resolve_path to resolve symlinks and enforce containment via Path.relative_to(root), and updates _prepare_inline_payload to skip any file resolving outside the working directory with a Skipped file outside working directory warning (GitHub Release, Fix Commit). If immediate upgrade is not possible, avoid using mode="inline" with untrusted files input, or run the server process under a restricted-permission user account with minimal filesystem access (Github Advisory).