CVE-2026-117560: ATXP Gemini CLI Extension through 1.0.0 OS Command Injection via MCP Tools
ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows attackers to execute shell commands through unsanitized MCP tool parameters. Attackers can plant instructions in email or SMS content to inject $() or backtick substitutions into parameters like messageid, subject, or query, running commands as the user.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users of the ATXP Gemini CLI extension through version 1.0.0 are exposed when MCP tool parameters can be influenced by email or SMS content. The injected commands run with the privileges of the user running the extension.
What does an attacker need to exploit it?
An attacker needs to cause crafted content to be passed into vulnerable MCP tool parameters such as message_id, subject, or query. The described payloads use shell command substitution syntax, including $() or backticks; no user interaction is identified in the provided vector.
What is the likely impact of successful exploitation?
Successful exploitation allows execution of arbitrary shell commands as the local user. This can affect confidentiality, integrity, and availability of resources accessible to that user.