Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a path traversal issue in the gemini-bridge library, specifically within the consult_gemini_with_files tool when used in inline mode. The root cause lies in the _resolve_path function, which, prior to the patch, failed to properly sanitize and confine user-provided file paths to the specified working directory. It was susceptible to absolute paths, ../ traversal, and symlink escapes.
The flaw was exploited in the _prepare_inline_payload function. This function would call _resolve_path, but would then proceed to use the returned absolute path to read a file via _read_file_for_inline, even if _resolve_path had signaled that the file was outside the designated directory. An attacker could therefore provide a malicious file path (e.g., /etc/passwd, ../../.ssh/id_rsa) in the files argument, and its contents would be read and returned in the tool's output.
The patch addresses this by hardening _resolve_path to use pathlib.Path.resolve() and relative_to(), ensuring paths are properly confined. It also modifies _prepare_inline_payload to explicitly check if the resolved path is within the directory and to skip any that are not. Any exploitation attempt would involve a call to consult_gemini_with_files, which would then trigger the vulnerable logic in _prepare_inline_payload and _resolve_path, ultimately leading to a file read by _read_file_for_inline.
consult_gemini_with_filessrc/mcp_server.py
_prepare_inline_payloadsrc/mcp_server.py
_resolve_pathsrc/mcp_server.py
_read_file_for_inlinesrc/mcp_server.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| gemini-bridge | pip | >= 1.0.0, < 1.3.1 | 1.3.1 |