Summary
ATXP Gemini CLI extension versions through 1.0.0 contain an OS command injection flaw in runAtxp() that passes insufficiently sanitized MCP tool parameters to shell execution.
Malicious instructions embedded in email or SMS content may influence fields such as message identifiers, subjects, or queries, allowing commands to run with the privileges of the user operating the CLI.
ATXP Gemini CLI extension versions through 1.0.0 contain an OS command injection flaw in runAtxp() that passes insufficiently sanitized MCP tool parameters to shell execution.
Malicious instructions embedded in email or SMS content may influence fields such as message identifiers, subjects, or queries, allowing commands to run with the privileges of the user operating the CLI.
Affected context
The vulnerability occurs when the ATXP Gemini CLI extension processes externally controlled email or SMS content and uses resulting MCP tool parameters in a shell command. Risk is present when untrusted values can reach runAtxp() without strict validation, safe argument handling, or separation from shell interpretation.
The vulnerability occurs when the ATXP Gemini CLI extension processes externally controlled email or SMS content and uses resulting MCP tool parameters in a shell command. Risk is present when untrusted values can reach runAtxp() without strict validation, safe argument handling, or separation from shell interpretation.
Exploit preconditions
- Attack surface: The ATXP Gemini CLI extension's MCP tool integration and
runAtxp()execution path - Required access: Ability to cause the target user or automation workflow to process attacker-controlled email or SMS content
- Trigger point: Handling a crafted value in parameters such as
message_id,subject, orquery - Why exploitation is possible: Unsanitized parameter data is interpreted by a shell, allowing command-substitution syntax or other shell metacharacters to alter execution
- Attack surface: The ATXP Gemini CLI extension's MCP tool integration and
runAtxp()execution path - Required access: Ability to cause the target user or automation workflow to process attacker-controlled email or SMS content
- Trigger point: Handling a crafted value in parameters such as
message_id,subject, orquery - Why exploitation is possible: Unsanitized parameter data is interpreted by a shell, allowing command-substitution syntax or other shell metacharacters to alter execution
Why this happens
The underlying bug is an unsafe boundary between untrusted text and shell command construction. Values originating from external messages are incorporated into a command without reliably treating them as data or using an argument-safe process interface.
This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, because shell syntax in attacker-influenced input can be interpreted as executable command logic.
The underlying bug is an unsafe boundary between untrusted text and shell command construction. Values originating from external messages are incorporated into a command without reliably treating them as data or using an argument-safe process interface.
This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, because shell syntax in attacker-influenced input can be interpreted as executable command logic.
Potential impact
- An attacker could execute arbitrary operating-system commands as the affected user
- Sensitive files, credentials, or environment data could be accessed
- The local development or automation environment could be modified
- Malware or persistence mechanisms could be installed
- Additional systems or services accessible to the user could be targeted
- An attacker could execute arbitrary operating-system commands as the affected user
- Sensitive files, credentials, or environment data could be accessed
- The local development or automation environment could be modified
- Malware or persistence mechanisms could be installed
- Additional systems or services accessible to the user could be targeted
General mitigation guidance
Mitigation generally focuses on removing shell interpretation from data-processing paths and reducing trust in message-derived values.
Common defensive patterns include:
- Use direct process-execution APIs with argument arrays instead of constructing shell command strings
- Apply strict allowlists, type checks, length limits, and canonicalization to tool parameters
- Treat email, SMS, and retrieved content as untrusted data, including embedded instructions
- Separate message retrieval from privileged actions and require explicit user confirmation for sensitive operations
- Run the CLI with least privilege and isolate credentials, files, and network access
- Avoid passing secrets or broad environment variables to child processes
- Enforce secure-by-default MCP tool policies that restrict command execution and external side effects
Mitigation generally focuses on removing shell interpretation from data-processing paths and reducing trust in message-derived values.
Common defensive patterns include:
- Use direct process-execution APIs with argument arrays instead of constructing shell command strings
- Apply strict allowlists, type checks, length limits, and canonicalization to tool parameters
- Treat email, SMS, and retrieved content as untrusted data, including embedded instructions
- Separate message retrieval from privileged actions and require explicit user confirmation for sensitive operations
- Run the CLI with least privilege and isolate credentials, files, and network access
- Avoid passing secrets or broad environment variables to child processes
- Enforce secure-by-default MCP tool policies that restrict command execution and external side effects
How teams detect issues like this
Detection can include static analysis for string concatenation, interpolation, or formatting used to build shell commands from MCP or message-derived values. Code review should examine every path from email, SMS, search results, and tool parameters to process-spawning APIs.
Runtime monitoring may flag unexpected child-process creation, shell invocation, command-substitution indicators in parameters, or unusual access to credentials and sensitive files. CI policy checks and automated security review tools can help identify shell execution APIs that receive unsanitized or indirectly sourced input.
Detection can include static analysis for string concatenation, interpolation, or formatting used to build shell commands from MCP or message-derived values. Code review should examine every path from email, SMS, search results, and tool parameters to process-spawning APIs.
Runtime monitoring may flag unexpected child-process creation, shell invocation, command-substitution indicators in parameters, or unusual access to credentials and sensitive files. CI policy checks and automated security review tools can help identify shell execution APIs that receive unsanitized or indirectly sourced input.
