{"id":"PYSEC-2026-3574","summary":"gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode","details":"### Summary\n`consult_gemini_with_files` in **inline mode** read any file path supplied in\nthe `files` argument without confining it to the working `directory`, then\nforwarded the contents to the Gemini CLI. Because the caller also controls\n`query`, the file contents are echoed back through the Gemini round-trip\n(and sent to Google), making this an arbitrary local file read.\n\n### Impact\nAn MCP client — or an LLM that has been prompt-injected into calling the tool —\ncan read **any file the server process can access** (SSH keys, cloud\ncredentials, `.env`, source) and have it disclosed via the tool response.\nNo code execution by itself.\n\n### Affected component\n- Tool: `consult_gemini_with_files(query, directory, files, …)`, `mode=\"inline\"`\n- Sink: `_read_file_for_inline` via `_prepare_inline_payload` in `src/mcp_server.py`\n- The `at_command` mode already confined paths; inline mode did not.\n\n### Root cause\n`_resolve_path` returned an out-of-root path while only nullifying the *display*\nname, and `_prepare_inline_payload` read the file regardless. Absolute paths,\n`..` traversal, and symlink escapes were all accepted.\n\n### Patch\nFixed in **1.3.1**. `_resolve_path` now resolves symlinks and confines via\n`Path.relative_to(root)`; inline mode skips any entry that resolves outside the\nworking directory (the same guard `at_command` already enforced).\n\n### Workarounds\nUpgrade to 1.3.1. Before upgrading, avoid `mode=\"inline\"` with untrusted\n`files` input, or run the server with a restricted-permission user.\n\n### Credit\nReported privately by Zhihao Zhang (WPI).","aliases":["CVE-2026-54785","GHSA-c5px-58j2-7fqp"],"modified":"2026-08-04T14:30:16.463267474Z","published":"2026-08-04T11:34:46.654048Z","references":[{"type":"WEB","url":"https://github.com/eLyiN/gemini-bridge/security/advisories/GHSA-c5px-58j2-7fqp"},{"type":"WEB","url":"https://github.com/eLyiN/gemini-bridge/pull/9"},{"type":"WEB","url":"https://github.com/eLyiN/gemini-bridge/commit/8f3b85afd02b692c4bc974b5176e12fb277ea801"},{"type":"PACKAGE","url":"https://github.com/eLyiN/gemini-bridge"},{"type":"WEB","url":"https://github.com/eLyiN/gemini-bridge/releases/tag/v1.3.1"},{"type":"PACKAGE","url":"https://pypi.org/project/gemini-bridge"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-c5px-58j2-7fqp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54785"}],"affected":[{"package":{"name":"gemini-bridge","ecosystem":"PyPI","purl":"pkg:pypi/gemini-bridge"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.3.1"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.5","1.1.0","1.1.1","1.2.0","1.3.0"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/gemini-bridge/PYSEC-2026-3574.yaml"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}