AIKIDO-2026-10421
@google/gemini-cli is vulnerable to Prototype Pollution
47
Medium Risk
This Affects:
@google/gemini-cliTL;DR
Affected versions of this package do not adequately block dangerous property keys during object assignment, allowing potential prototype pollution through constructor and prototype in addition to __proto__. An attacker might exploit this by supplying crafted input that injects properties into shared object prototypes, which can lead to application-wide tampering, unexpected behavior, denial of service, or, in some cases, security control bypass depending on how polluted objects are later used.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@google/gemini-cli is vulnerable to Prototype Pollution in versions 0.0.77 - 0.33.2.
How to fix this
Upgrade the @google/gemini-cli library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant