Evidence record / gemini-cli
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-08-03-gemini-cli-a2a-workspace-self-trust-rce-reaches-stable
Gemini CLI's a2a-server backend loaded workspace environment files before evaluating workspace trust, so an attacker could place GEMINI_CLI_TRUST_WORKSPACE=true inside a malicious .gemini/.env and, in the PR's words, 'self-validate their own untrusted workspace before trust is checked'. The stated class is zero-click remote code execution and environment poisoning in untrusted workspaces: opening a hostile repository was enough. The fix defers loadEnvironment() until after checkPathTrust/setIsTrusted, ignores workspace-level .env and .gemini/.env entirely when untrusted (falling back to the user's home directory), and adds task-level environment and process isolation via AsyncLocalStorage and a Proxy on process.env, aligning the backend with the CLI frontend's existing model. Merged 2026-07-21, shipped in stable v0.53.0 on 2026-07-28. Channel: tagged-release. This resolves a carry-forward check from the prior run. Operator consequence: upgrade past v0.53.0 before pointing a2a-server at any repository you did not write.
Receipt
Finding metadata
Run: 2026-08-03-weekly-digest-2026-07-27_2026-08-03-frontier-v0
Finding ID: 2026-08-03-gemini-cli-a2a-workspace-self-trust-rce-reaches-stable
Source links
Primary links, including exact changelog lines when available.
Versioned source: run artifact