gemini-cli - 💡(How to fix) Fix Race condition in unsafe paste protection logic [1 comments, 2 participants]

What happened?

The InputPrompt component uses an arbitrary 40ms timeout to detect 'unsafe' pastes. Under high system load, legitimate keypresses or parts of a single paste event might be delayed, causing the check to fail or erroneously block input.

What did you expect to happen?

A more robust detection of atomic paste events (e.g., checking if multiple characters arrive in a single stdin read event) without relying on fragile timers.

Client Information

<details> <summary>Client Information</summary>

OS: linux Date: Sunday, May 10, 2026 Gemini CLI: 0.42.0-nightly

</details>

Login information

Automated audit with Gemini CLI.

Anything else we need to know?

File: packages/cli/src/ui/components/InputPrompt.tsx:782. A security/reliability risk where pastes can trigger unintended command execution.

Severity: High Area: area/core