gemini-mcp-tool execAsync Command Injection & @file Exfiltration (CVE-2026-0755) - ATR-2026-01931 (ee4442d3-ed22-5a37-9886-6dbe047eea23)
Detects exploitation of CVE-2026-0755 (CVSS 9.8) in the npm package gemini-mcp-tool (affected 1.1.2 ≤ v < 1.1.6). Two co-located vectors: (1) the execAsync method passes user-controlled prompt text to the OS shell without neutralising metacharacters (CWE-78), so a prompt carrying ;, |, $(...), backticks, or && chained to a command achieves unauthenticated RCE; (2) the Gemini CLI @file parser dereferences attacker-supplied @-paths, letting an injected prompt read/exfiltrate arbitrary local files such as @/etc/passwd, @~/.ssh/id_rsa, @~/.aws/credentials, or @../../secret. No prior ATR rule is keyed to the gemini-mcp-tool @file / execAsync vector.