CVE-2026-117560: ATXP Gemini CLI Extension OS Command Injection

# CVE-2026-117560: ATXP Gemini CLI Extension OS Command Injection

https://gcdradar.vercel.app/incidents/cve-2026-117560-atxp-gemini-cli-extension-os-command-injecti · AIR-2026-1575 · closed 2026-10-27

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): Disclosed vulnerability with no confirmed exploitation and a high rating.
- Fix status: Fix status unknown
- First reported: 2026-10-27
- AI role: Attack on AI
- Products: ATXP Gemini CLI extension
- CVE ids: CVE-2026-117560
- CVSS: 8.5

## Summary

The ATXP Gemini CLI extension contains an OS command injection vulnerability in runAtxp() allowing shell command execution via unsanitized tool parameters. Attackers can plant instructions in emails or SMS to trigger command execution as the user.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Affected and fixed versions

- Affected: ATXP Gemini CLI extension <= 1.0.0

## Latest updates

- 2026-10-27: CVE-2026-117560: ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows attackers to… (https://nvd.nist.gov/vuln/detail/CVE-2026-117560)

## Sources

- 2026-10-27 NVD: CVE-2026-117560: ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows attackers to… https://nvd.nist.gov/vuln/detail/CVE-2026-117560

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.