Google has fixed two security vulnerabilities in its Gemini CLI and Cursor tools. The first, with a CVSS score of 10, allowed remote code execution (RCE) through the command-line interface. The second flaw, present in the Cursor editor, also enabled unauthorized command execution. Both posed a serious risk to developers and users, as an attacker could compromise systems without user interaction.
Technical details of the fixed vulnerabilities 🛡️
The vulnerability in Gemini CLI, classified as critical, exploited a flaw in handling user input to inject arbitrary commands. In Cursor, the error lay in insufficient parameter validation when processing files, which allowed remote code execution. Both flaws affected recent versions of the tools. Google recommends updating to the patched versions immediately. No cases of active exploitation have been reported, but the risk was high due to the widespread use of these tools in development environments.
When the code assistant wants to be a hacker 😈
So, according to Google, your favorite AI tools could turn your terminal into a playground for hackers. All without you lifting a finger. Gemini CLI and Cursor, designed to help you code, almost helped you get your system hacked. Good thing Google fixed it before some clever person decided your source code was a good place for unauthorized vacations. Update, because AI is already unpredictable enough without these holes.