Nightly only
A Gemini CLI nightly closes a path from a repository’s build file to the agent’s own flags
The fix has not reached a stable release; the newest one is still 0.59.0 from 8 September.
Google merged a fix titled “prevent indirect prompt injection via build file modifications and untrusted flags” into a Gemini CLI nightly published on 12 September.
Google’s own merge description names the vector, and it is one a reviewer skims. A build file is not prose the agent reads, it is configuration the agent obeys, so text placed in it by whoever last touched the repository could reach the agent as flags rather than as content. A second merge in the same nightly hardens the sandbox’s filesystem boundaries and isolates runtime state.
You cannot install this from a stable release. The newest stable tag is 0.59.0, published on 8 September, and the 0.61.0 line exists only as prereleases whose notes run to two fix lines and nothing else.
Neither merge carries a CVE or an advisory, so there is no affected-version range to read and no way to tell whether the stable line is exposed.
What it changes If you point Gemini CLI at repositories you do not control, treat build files as untrusted input today rather than waiting for the fix to reach stable. There is no advisory, so you cannot check whether 0.59.0 is affected.
The two merges are described only by their pull-request titles on the release page. No advisory, CVE or affected-version range has been published for either, so the exposure of the stable line is unknown.
Primary source read
gemini-cli v0.61.0-nightly.20260912 gemini-cli latest stable release