Finding / gemini-cli

2026-09-21-gemini-cli-extension-install-still-checks-out-fetch-head-after-plugin4shell-disclosure

AIR Security published Plugin4Shell on 2026-09-17: agents that install a plugin by pinned commit do not verify the checkout resolved to that commit. For Gemini CLI the write-up says the installer runs git fetch then git checkout FETCH_HEAD, and a repository whose default branch is named FETCH_HEAD makes checkout resolve to the branch and discard the fetched commit. AIR reports Google answered on 2026-08-04 that Gemini CLI is deprecated and will not be patched. At v0.60.0, packages/cli/src/config/extensions/github.ts line 72 is still git.checkout(‘FETCH_HEAD’). The same window shipped four security-heavy stables.

Channel: tagged-release (unfixed at v0.60.0). Half: defect.

Operator consequence: Install Gemini CLI extensions only from repositories you control or can re-verify by hash after install (git rev-parse HEAD inside the extension directory). The attack needs control of the extension repository; Whether a given git host accepts a branch named FETCH_HEAD is the host’s answer, not Gemini CLI’s.

Receipt

Finding metadata

Confidence: high

Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0

Finding ID: 2026-09-21-gemini-cli-extension-install-still-checks-out-fetch-head-after-plugin4shell-disclosure

Accepted signals

A pinned plugin commit was a request, not a check, in four agents / 2026-09-21

Profile citations

Gemini CLI / claim / plugin4shell-unpatched
Gemini CLI / posture / governance

Source links

Primary links, including exact changelog lines when available.

Gemini CLI
tagged commit file2026-09-21-gemini-cli-extension-install-still-checks-out-fetch-head-after-plugin4shell-disclosuregoogle-gemini/gemini-cli / packages/cli/src/config/extensions/github.ts third party research2026-09-21-gemini-cli-extension-install-still-checks-out-fetch-head-after-plugin4shell-disclosurewww.air.security/blog-posts/plugin4shell