gemini-cli - 💡(How to fix) Fix Arbitrary Workspace Path Injection [1 comments, 2 participants]

What happened?

The /tasks endpoint allows clients to specify a workspacePath in the agentSettings. This path is later used to set the target directory for the agent's operations.

What did you expect to happen?

The workspace path should be restricted to a set of allowed directories or validated against a root path to prevent path traversal and access to sensitive system files.

Client Information

<details> <summary>Client Information</summary>

OS: linux Date: Sunday, May 10, 2026 Gemini CLI: 0.42.0-nightly

</details>

Login information

Automated audit with Gemini CLI.

Anything else we need to know?

File: packages/a2a-server/src/http/app.ts, Lines 231-240 and packages/a2a-server/src/agent/executor.ts, Lines 97-111. An attacker can point the agent to /etc or other sensitive directories and use the agent's tools to read or modify files.

Severity: Critical Area: area/security