Gemini CLI allowlist bypass and silent execution (Tracebit)

What happened

• A prompt-injected README plus a weak allowlist check ran hidden commands. Fixed: 0.1.14.

Sources

• https://tracebit.com/blog/code-exec-deception-gemini-ai-cli-hijack

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.