Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets

CVE-2026-54316CVE-2026-12537

August 7, 2026 · The Hacker News · Severity: HIGH

Researchers at Novee Security demonstrated at Black Hat USA that a GitHub issue from an unprivileged account could be enough to execute arbitrary code on the CI runners powering Anthropic's and Google's own coding-agent repositories, or hijack the next agent run on OpenAI's infrastructure. The attacks were executed against each vendor's agent in its default shipping configuration, revealing that the core weakness across all three platforms lies in the harness — the code surrounding the model that determines what actually runs — rather than in the models themselves. Two CVEs were issued and subsequently patched. The most severe is CVE-2026-12537 (CVSS 4 score: 10.0), an OS command injection in Google's Gemini CLI container launcher reachable through a crafted .gemini/.env file, allowing an unprivileged attacker to execute code on the host before the sandbox initializes. Fixed in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22, this bug required no model manipulation whatsoever. In Claude Code, CVE-2026-54316 weaponized Hugging Face's public download counter as an exfiltration channel to leak API keys one character at a time, affecting every Claude Code release from 0.2.54 through 2.1.163 before the fix in version 2.1.163. OpenAI's Codex finding produced neither a patch nor a CVE, as the vendor considered the sandbox behavior to be working as documented.

A GitHub issue opened by an account with no repository privileges was enough to execute code on the CI runners behind Anthropic's and Google's own coding-agent repositories. On OpenAI's, it was enough to hijack the next agent run. Novee Security ran the attack against each vendor's agent in the configuration that the vendor ships by default, and presented the work at Black Hat USA on August 5. Two CVEs came out of it. Both are patched. Gemini CLI carries the worst of the two. CVE-2026-12537 (CVSS 4 score: 10.0) is an OS command injection in the container launcher, reached through a crafted .gemini/.env file, which lets an unprivileged attacker run code on the host of a headless CI platform before the sandbox starts. It is fixed in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22. In Claude Code, CVE-2026-54316 turned Hugging Face's public download counter into an exfiltration channel that leaked an API key one character at a time, and is fixed in 2.1.163.

Key Takeaways

Novee Security demonstrated at Black Hat USA that a GitHub issue from an unprivileged account could execute code on CI runners for Anthropic's and Google's coding agents.
CVE-2026-12537 (CVSS 4: 10.0) is an OS command injection in Gemini CLI's container launcher, fixed in version 0.39.1 and run-gemini-cli 0.1.22.
CVE-2026-54316 affects Claude Code from version 0.2.54 through 2.1.163, using Hugging Face's download counter as an API key exfiltration channel.