CVE-2026-0755: gemini-mcp-tool OS Command Injection and File Exfiltration via Prompt Quoting

union DeviceProcessEvents, DeviceFileEvents, DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessCommandLine has_any ("gemini-mcp-tool", "gemini_mcp") or ProcessCommandLine has_any ("gemini-mcp-tool", "gemini_mcp")
| extend SuspiciousShell = ProcessCommandLine has_any ("bash -c", "sh -c", "cmd /c", "powershell -enc", "$(")
| extend FileExfil = ProcessCommandLine matches regex @"@[A-Za-z0-9_\-\./:]{2,}"
| extend OsInjection = ProcessCommandLine matches regex @"[;&|`$(){}\[\]<>]"
| where SuspiciousShell or FileExfil or OsInjection
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine, FileName, SuspiciousShell, FileExfil, OsInjection
| order by Timestamp desc

index=* (sourcetype=sysmon OR sourcetype=auditd OR sourcetype=osquery:results OR sourcetype=endpoint)
| search (process_name="node" OR process_exec="*gemini-mcp*" OR cmdline="*gemini-mcp-tool*")
| eval suspicious_shell=if(match(cmdline, "(bash\s+-c|sh\s+-c|cmd\s+/c|powershell\s+-enc|\$\()"), 1, 0)
| eval file_exfil=if(match(cmdline, "@[A-Za-z0-9_.\-/:]{2,}"), 1, 0)
| eval os_injection=if(match(cmdline, "[;&|`\$(){}\[\]<>]"), 1, 0)
| where suspicious_shell=1 OR file_exfil=1 OR os_injection=1
| table _time host user process_name cmdline parent_process suspicious_shell file_exfil os_injection
| sort -_time

sequence by host.id with maxspan=2m
  [process where event.type == "start"
   and (process.name == "node" or process.command_line like~ "*gemini-mcp-tool*")
   and process.command_line regex~ ".*(@[A-Za-z0-9_.\-/:]{2,}|[;&|`$(){}\[\]<>]|bash\s+-c|sh\s+-c).*"]
  [process where event.type == "start"
   and process.parent.name == "node"
   and process.name in ("bash", "sh", "cmd.exe", "powershell.exe", "python", "python3", "perl", "ruby", "curl", "wget")]

SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS 'Event Time', sourceip, username, "Process Name", "Command", QIDNAME(qid) AS 'Event Name'
FROM events
WHERE ("Process Name" ILIKE '%node%' OR "Command" ILIKE '%gemini-mcp-tool%' OR "Command" ILIKE '%gemini_mcp%')
AND ("Command" ILIKE '%bash -c%' OR "Command" ILIKE '%sh -c%' OR "Command" ILIKE '%cmd /c%' OR "Command" LIKE '%@/%' OR "Command" LIKE '%@C:%' OR "Command" RLIKE '.*[;&|`$(){}\[\]<>].*')
AND LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Linux OS', 'SyslogNG Generic', 'Sysmon')
LAST 7 DAYS
ORDER BY starttime DESC

_sourceCategory=endpoint/process OR _sourceCategory=os/linux/audit OR _sourceCategory=windows/sysmon
| where process_name matches /node/ or command matches /gemini-mcp-tool/ or command matches /gemini_mcp/
| where command matches /(@[A-Za-z0-9_.\-\/:]{2,})/ or command matches /[;&|`$(){}\[\]<>]/ or command matches /(bash\s+-c|sh\s+-c|cmd\s+\/c|powershell\s+-enc)/
| eval injection_type = if(command matches /(@[A-Za-z0-9_.\-\/:]{2,})/, "file_exfil", if(command matches /(bash\s+-c|sh\s+-c)/, "shell_spawn", "metachar_injection"))
| count by _sourceHost, user, process_name, command, injection_type
| order by _count desc

rule cve_2026_0755_gemini_mcp_injection {
  meta:
    author = "df00tech detection engineering"
    description = "Detects CVE-2026-0755 OS command injection in gemini-mcp-tool"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/jamubc/gemini-mcp-tool/security/advisories/GHSA-4h5r-5jm8-jxjm"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      $e.principal.process.file.full_path = /node/ nocase or
      $e.principal.process.command_line = /gemini-mcp-tool/ nocase or
      $e.principal.process.command_line = /gemini_mcp/ nocase
    )
    (
      $e.principal.process.command_line = /@[A-Za-z0-9_.\-\/:]{2,}/ or
      $e.principal.process.command_line = /[;&|`$(){}\[\]<>]/ or
      $e.principal.process.command_line = /bash\s+-c|sh\s+-c|cmd\.exe\s+\/c/ nocase
    )
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| CommandLine = /gemini-mcp-tool|gemini_mcp/i OR ImageFileName = /node(\.exe)?$/i
| CommandLine = /(@[A-Za-z0-9_.\-\/:]{2,})|([;&|`$(){}\[\]<>])|(bash\s+-c|sh\s+-c|cmd\.exe\s+\/c|powershell\s+-enc)/i
| eval InjectionType = case(
    CommandLine = /@[A-Za-z0-9_.\-\/:]{2,}/, "file_exfiltration",
    CommandLine = /bash\s+-c|sh\s+-c/, "shell_injection",
    CommandLine = /powershell\s+-enc|cmd\.exe\s+\/c/, "windows_shell_injection",
    true(), "metachar_injection"
  )
| table timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, InjectionType
| sort timestamp desc