CVE-2026-0755: Critical OS Command Injection in gemini-mcp-tool Enables Arbitrary Code Execution and File Exfiltration

Vulnerability Overview

CVE-2026-0755 is a critical OS command injection vulnerability (CWE-78) in the npm package gemini-mcp-tool, carrying a CVSS score of 9.8. The root cause is insufficient sanitization of user-supplied prompt strings before they are passed to underlying shell execution contexts. Attackers can embed unescaped shell metacharacters or @file directives into crafted prompts, causing the tool to execute arbitrary OS commands or exfiltrate local files on the host system. The impact is severe: full arbitrary code execution and sensitive file disclosure without authentication or elevated privilege requirements.

Affected Software

The vulnerability affects the gemini-mcp-tool npm package in versions >= 1.1.2 and < 1.1.6. No vendor patch date has been confirmed at time of publication. Any environment running an affected version of this MCP tool — including developer workstations, CI pipelines, or AI-integrated infrastructure — is exposed.

Exploitation Status

A public proof-of-concept (PoC) exists for this vulnerability, disclosed on 18 June 2026. While no confirmed in-the-wild exploitation has been reported, the availability of a public PoC significantly lowers the bar for opportunistic attackers. Given the nature of MCP (Model Context Protocol) tooling — which often runs with broad local filesystem and shell access — exploitation could result in supply chain compromise, credential theft, or lateral movement. Defenders should treat this as actively weaponisable and prioritise detection and remediation immediately.

Detection Coverage

df00tech ships detection logic for CVE-2026-0755 across seven SIEM platforms, giving SOC teams broad coverage regardless of stack:

• Microsoft Sentinel (KQL) — Identifies suspicious process spawning patterns and shell metacharacter sequences originating from MCP tool processes.
• Splunk (SPL) — Correlates command execution events with gemini-mcp-tool process ancestry and anomalous argument strings.
• Elastic (EQL) — Sequences process creation events to flag shell injection chains and @file-style directive abuse.
• IBM QRadar (AQL) — Queries flow and event data for OS command injection indicators linked to npm-based MCP processes.
• Sumo Logic — Log search rules targeting shell execution context anomalies from Node.js MCP tool invocations.
• Google Chronicle (YARA-L) — Behavioural rules matching prompt-driven shell execution and file read patterns consistent with this CVE.
• CrowdStrike (CQL) — Falcon telemetry queries detecting process injection and file exfiltration behaviour from affected tool versions.

The detection logic focuses on three core signals: anomalous child process spawning from the MCP tool, shell metacharacter presence in process arguments, and unexpected file access patterns — particularly reads of credential or configuration files following tool invocation.

Recommendations

• Immediately upgrade gemini-mcp-tool to version 1.1.6 or later.
• Audit npm lockfiles and dependency trees for any pinned vulnerable versions.
• Restrict MCP tool execution environments using sandboxing and least-privilege process controls.
• Deploy the detections below and alert on any hits — given the public PoC, false-positive tolerance should be low.

Full detection queries, playbook guidance, and atomic test cases for CVE-2026-0755 are available on the CVE-2026-0755 detection page. A df00tech subscription is required to access the complete rule set and purple team content.