6.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54785

CVE-2026-54785: gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

Summary

consult_gemini_with_files in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip (and sent to Google), making this an arbitrary local file read.

Impact

An MCP client — or an LLM that has been prompt-injected into calling the tool — can read any file the server process can access (SSH keys, cloud credentials, .env, source) and have it disclosed via the tool response. No code execution by itself.

Affected component

Tool: consult_gemini_with_files(query, directory, files, …), mode="inline"
Sink: _read_file_for_inline via _prepare_inline_payload in src/mcp_server.py
The at_command mode already confined paths; inline mode did not.

Root cause

_resolve_path returned an out-of-root path while only nullifying the display name, and _prepare_inline_payload read the file regardless. Absolute paths, .. traversal, and symlink escapes were all accepted.

Patch

Fixed in 1.3.1. _resolve_path now resolves symlinks and confines via Path.relative_to(root); inline mode skips any entry that resolves outside the working directory (the same guard at_command already enforced).

Workarounds

Upgrade to 1.3.1. Before upgrading, avoid mode="inline" with untrusted files input, or run the server with a restricted-permission user.

Credit

Reported privately by Zhihao Zhang (WPI).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54785

CVE-2026-54785:

6.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gemini-bridge	pip	>= 1.0.0, < 1.3.1	1.3.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal issue in the gemini-bridge library, specifically within the consult_gemini_with_files tool when used in inline mode. The root cause lies in the _resolve_path function, which, prior to the patch, failed to properly sanitize and confine user-provided file paths to the specified working directory. It was susceptible to absolute paths, ../ traversal, and symlink escapes.

The flaw was exploited in the _prepare_inline_payload function. This function would call _resolve_path, but would then proceed to use the returned absolute path to read a file via _read_file_for_inline, even if _resolve_path had signaled that the file was outside the designated directory. An attacker could therefore provide a malicious file path (e.g., /etc/passwd, ../../.ssh/id_rsa) in the files argument, and its contents would be read and returned in the tool's output.

The patch addresses this by hardening _resolve_path to use pathlib.Path.resolve() and relative_to(), ensuring paths are properly confined. It also modifies _prepare_inline_payload to explicitly check if the resolved path is within the directory and to skip any that are not. Any exploitation attempt would involve a call to consult_gemini_with_files, which would then trigger the vulnerable logic in _prepare_inline_payload and _resolve_path, ultimately leading to a file read by _read_file_for_inline.

Vulnerable functions

consult_gemini_with_files

src/mcp_server.py

This is the main tool function that a user or a prompt-injected LLM would call. When used with `mode="inline"`, it orchestrates the file reading process that leads to the vulnerability by calling `_prepare_inline_payload` without proper path confinement in the vulnerable version.

_prepare_inline_payload

src/mcp_server.py

This function is directly responsible for the vulnerability. Before the patch, it would proceed to read a file using its absolute path (`abs_path`) even if `_resolve_path` determined the file was outside the allowed directory (`rel_path` was None). The patch adds a check to ensure that files outside the working directory are skipped.

_resolve_path

src/mcp_server.py

This function contained the root cause of the path traversal vulnerability. The original implementation did not correctly handle absolute paths, path traversal sequences (`..`), or symlinks, allowing a caller to craft a file path that resolved outside the intended working directory. The patch replaced this weak logic with `Path.resolve()` and `Path.relative_to()` for a secure implementation.

_read_file_for_inline

src/mcp_server.py

This function is the sink where the arbitrary file read occurs. While not vulnerable in isolation, it is the function that ultimately reads the file from the filesystem using the unvalidated path provided by `_prepare_inline_payload`. During an exploit, this function would appear in the stack trace as it reads the contents of the targeted file.