Black Hat: One Public GitHub Issue Reaches CI Secrets Through Claude Code and Gemini CLI
Novee Security disclosed at Black Hat USA on August 5 (reported August 7) that an outside user with no repository privileges could open a public GitHub issue and turn agent-driven CI workflows against their own repos, exposing the runner's repository token and any workflow-injected secrets. CVE-2026-12537 in Gemini CLI (CVSS v4 10.0) is an OS command injection in the container launcher reached via a crafted `.gemini/.env` file, executing on the CI host before the sandbox starts — fixed in 0.39.1 and run-gemini-cli 0.1.22. CVE-2026-54316 in Claude Code (Anthropic rates CVSS v4 6.0; NVD rates CVSS v3.1 9.1) turned Hugging Face's public download counter into an exfiltration channel that leaked an API key one character at a time, affecting 0.2.54 through 2.1.163.
↳ Follow the thread