npmPackage

@google/gemini-cli

1 known vulnerability (1 critical), with the versions each affects and the releases that fix them.

Latest release: 0.67.0 (Nov 4, 2026): no advisory affects it
Newest unaffected release: 0.67.0 (Nov 4, 2026), the latest release
Advisories: 1 · 1 critical

Weekly downloads: 445.9K
Dependents: 6
Releases: 500+ since 0.18.0 (Nov 26, 2025)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-12537
Affects 0.18.0 to 0.39.0 (0.39.1 is outside it); 0.40.0-preview.2 (0.40.0-preview.3 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 1

CVE-2026-12537Critical 10.0
Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows
Affected: fixed in 0.39.1; from 0.40.0-preview.2, fixed in 0.40.0-preview.3.
Fixed in 0.39.1 (released Apr 24, 2026, 61 days before disclosure) and 0.40.0-preview.3 (released Apr 24, 2026, 61 days before disclosure).
The latest release, 0.67.0, is not affected.
25% of @google/gemini-cli downloads last week were affected versions (153.9K).