gemini-cli - 💡(How to fix) Fix Insecure file permissions for background process logs [1 comments, 2 participants]

What happened?

Background process logs are created without explicit restrictive permissions, potentially using the default umask which might allow other users to read sensitive command output.

What did you expect to happen?

Logs should be created with restrictive permissions (e.g., 0600) to ensure only the owner can read them.

Client Information

<details> <summary>Client Information</summary>

OS: linux Date: Sunday, May 10, 2026 Gemini CLI: 0.42.0-nightly

</details>

Login information

Automated audit with Gemini CLI.

Anything else we need to know?

File: packages/core/src/services/shellExecutionService.ts, Line 648. While the parent directory has 0700, the files themselves should also be protected.

Severity: High Area: area/security