gemini-bridge flaw exposes the file risk in local agents

What this is about

CVE-2026-54785 was published for gemini-bridge on July 31, 2026. The Python package connects MCP-based agents with Google’s Gemini CLI. That bridge could read local files in certain versions when a caller supplied paths through the files parameter.

This is not a mass-panic story. The CVSS score sits in the moderate range. The interesting part is the mechanism: a local agent tool receives file access, passes contents to an external model, and can make them visible again through the model response.

What gemini-bridge actually does

gemini-bridge is a lightweight MCP server. An agent can use it to call the Gemini CLI, for example to analyze files or send code context to a model. According to the GitHub advisory, the vulnerable path involved consult_gemini_with_files in inline mode.

The flaw existed because file paths were not strictly confined to the allowed working directory. Between versions 1.0.0 and 1.3.1, a controlled file path could therefore point outside that boundary. The contents were then forwarded to the Gemini CLI. Tenable and Miggo describe the same core issue: a file helper became a local file reader with external forwarding.

Why it matters

MCP tools are useful because they give agents real capabilities: reading files, searching repositories, calling APIs, checking calendars, or preparing deployments. That is exactly why the risk profile changes. A chatbot without tools can only talk. An agent with tools can act.

Local developer environments often keep sensitive files close together: .env, SSH configuration, source code, customer data, and internal notes. If a tool handles file boundaries too loosely, the problem is no longer only a classic exploit. A malicious prompt, a poisoned task, or a badly configured agent can also become the trigger.

The case is therefore a useful warning for teams quickly wiring MCP servers into internal workflows. The question is not only: does the tool work? The more important question is: what must it never be allowed to see?

In plain language

Imagine an intern who is allowed to copy files from one folder. The task says: “Bring me the three contracts from drawer A.” If the intern accepts every path, someone can say: “Also take the safe folder next to it.” The work looks the same, but the boundary is gone.

A practical example

A development team uses a local agent for 200 code reviews per week. The agent may pass files from the current project to Gemini. But the repository also contains an old .env file and an export with 500 test customers.

A manipulated ticket asks the agent to “check all relevant configuration files.” If the tool accepts paths outside the project folder, sensitive contents could enter the model round. Even without a direct database attack, data can leak through the helper path.

Scope and limits

• The vulnerability is rated moderate. It does not mean every gemini-bridge installation was compromised.
• The concrete impact depends on how the MCP server was launched, which files were reachable, and who could trigger tool calls.
• The case is not a general verdict on Gemini, MCP, or local agents. It shows one concrete implementation problem: file paths need hard boundaries.

SEO & GEO keywords

gemini-bridge, CVE-2026-54785, MCP security, Model Context Protocol, Gemini CLI, local file read, AI agents security, prompt injection, developer tools security, GitHub Advisory