{"id":"CVE-2026-117560","kind":"vulnerability","aliases":["CVE-2026-117560"],"related":[],"title":"ATXP Gemini CLI extension: shell command injection through MCP tool parameters","description":"ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows attackers to execute shell commands through unsanitized MCP tool parameters. Attackers can plant instructions in email or SMS content to inject $() or backtick substitutions into parameters like message_id, subject, or query, running commands as the user.","summary":"The ATXP extension for Gemini CLI (version 1.0.0 and earlier) passes MCP tool parameters into a shell command without sanitizing them. An attacker who plants text such as $() or backtick substitutions in an email or SMS can get commands run as the user running Gemini CLI.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","atxp","gemini-cli","mcp"],"not_affected_if":["extension-not-installed","no-email-or-sms-input"],"how_to_check":"- Check whether the ATXP Gemini CLI extension is installed and which version it is, for example by listing installed Gemini CLI extensions\n- Look for runAtxp() in the installed extension's source\n- unknown for a specific version check command, the sources do not say","fix":"- Update or remove the ATXP Gemini CLI extension; the sources do not name a fixed version, so the fix is unknown\n- Until a fix is confirmed, disable the extension and avoid having it read email or SMS content","status":"open","published_at":"2026-10-27T14:16:38+00:00","first_seen_at":"2026-10-27T14:32:19+00:00","triaged_at":"2026-10-27T14:32:52+00:00","updated_at":"2026-10-27T14:32:52+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-27T14:32:52Z","model":"claude-haiku-5-5","output":{"fix":"- Update or remove the ATXP Gemini CLI extension; the sources do not name a fixed version, so the fix is unknown\n- Until a fix is confirmed, disable the extension and avoid having it read email or SMS content","reach":"unknown","title":"ATXP Gemini CLI extension: shell command injection through MCP tool parameters","impact":"high","summary":"The ATXP extension for Gemini CLI (version 1.0.0 and earlier) passes MCP tool parameters into a shell command without sanitizing them. An attacker who plants text such as $() or backtick substitutions in an email or SMS can get commands run as the user running Gemini CLI.","category":"ai-tooling","nicknames":[],"who_cares":["gemini-cli","atxp","mcp","ai-agents"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Commands run as the user running Gemini CLI.","analyst_note":"Find the fixed version or patch status for the ATXP Gemini CLI extension and confirm the attack path; the NVD entry in the sources does not name either.","how_to_check":"- Check whether the ATXP Gemini CLI extension is installed and which version it is, for example by listing installed Gemini CLI extensions\n- Look for runAtxp() in the installed extension's source\n- unknown for a specific version check command, the sources do not say","needs_analyst":true,"not_affected_if":["extension-not-installed","no-email-or-sms-input"],"who_is_affected":"Teams that run the ATXP extension for Gemini CLI at version 1.0.0 or earlier and let it process email or SMS content through MCP tools are exposed. The sources do not say whether other ATXP components or other Gemini CLI extensions are affected, so those are unknown; users who do not have this extension installed can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000665,"input_tokens":3345,"output_tokens":660,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-117560':14A,17A '-2026':13A,16A '1.0.0':36B,80C 'agent':20B 'ai':19B,22B 'ai-ag':18B 'ai-tool':21B 'allow':90C 'attack':51B,91C,101C 'atxp':1A,24B,30B,75C 'backtick':58B,113C 'cli':3A,27B,34B,74B,77C 'command':6A,46B,67B,84C,95C,124C 'contain':81C 'content':109C 'cve':12A,15A 'earlier':38B 'email':62B,106C 'execut':93C 'extens':4A,31B,78C 'gemini':2A,26B,33B,73B,76C 'gemini-c':25B 'get':66B 'id':119C 'inject':7A,85C,111C 'instruct':104C 'like':117C 'mcp':9A,28B,40B,98C 'messag':118C 'os':83C 'paramet':11A,42B,100C,116C 'pass':39B 'plant':53B,103C 'queri':122C 'run':68B,72B,123C 'runatxp':88C 'sanit':48B 'shell':5A,45B,94C 'sms':64B,108C 'subject':120C 'substitut':59B,114C 'text':54B 'tool':10A,23B,41B,99C 'unsanit':97C 'user':71B,127C 'version':35B 'vulner':86C 'without':47B","nicknames":[],"mitigations":[],"who_affected":"Teams that run the ATXP extension for Gemini CLI at version 1.0.0 or earlier and let it process email or SMS content through MCP tools are exposed. The sources do not say whether other ATXP components or other Gemini CLI extensions are affected, so those are unknown; users who do not have this extension installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117560","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117560","severity":null,"published_at":"2026-10-27T14:16:38+00:00","modified_at":"2026-10-27T14:16:38+00:00","first_seen_at":"2026-10-27T14:32:19+00:00","fetched_at":"2026-10-27T14:32:19+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}