---
id: "CVE-2026-117560"
kind: "vulnerability"
aliases: ["CVE-2026-117560"]
title: "ATXP Gemini CLI extension: shell command injection through MCP tool parameters"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-agents", "ai-tooling", "atxp", "gemini-cli", "mcp"]
not_affected_if: ["extension-not-installed", "no-email-or-sms-input"]
published_at: "2026-10-27T14:16:38+00:00"
first_seen_at: "2026-10-27T14:32:19+00:00"
updated_at: "2026-10-27T14:32:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117560", "first_seen_at": "2026-10-27T14:32:19+00:00"}]
---

# ATXP Gemini CLI extension: shell command injection through MCP tool parameters

The ATXP extension for Gemini CLI (version 1.0.0 and earlier) passes MCP tool parameters into a shell command without sanitizing them. An attacker who plants text such as $() or backtick substitutions in an email or SMS can get commands run as the user running Gemini CLI.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the ATXP Gemini CLI extension is installed and which version it is, for example by listing installed Gemini CLI extensions
- Look for runAtxp() in the installed extension's source
- unknown for a specific version check command, the sources do not say

## Fix

- Update or remove the ATXP Gemini CLI extension; the sources do not name a fixed version, so the fix is unknown
- Until a fix is confirmed, disable the extension and avoid having it read email or SMS content

## Timeline

- 2026-10-27T14:32:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117560

## From the sources

ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows attackers to execute shell commands through unsanitized MCP tool parameters. Attackers can plant instructions in email or SMS content to inject $() or backtick substitutions into parameters like message_id, subject, or query, running commands as the user.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_