From 2c149540104b8945b1eba9bfa7ac84db71b5ffe5 Mon Sep 17 00:00:00 2001 From: Mundur <150439604+M0nd0R@users.noreply.github.com> Date: Wed, 22 Apr 2026 01:31:10 +0800 Subject: [PATCH] Fix: Disallow overriding IDE stdio via workspace .env (RCE) (#25022) Co-authored-by: Tommaso Sciortino --- packages/cli/src/config/settings.ts | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/packages/cli/src/config/settings.ts b/packages/cli/src/config/settings.ts index 40d275e79e..616b2caf49 100644 --- a/packages/cli/src/config/settings.ts +++ b/packages/cli/src/config/settings.ts @@ -78,7 +78,12 @@ export function getMergeStrategyForPath( export const USER_SETTINGS_PATH = Storage.getGlobalSettingsPath(); export const USER_SETTINGS_DIR = path.dirname(USER_SETTINGS_PATH); -export const DEFAULT_EXCLUDED_ENV_VARS = ['DEBUG', 'DEBUG_MODE']; +export const DEFAULT_EXCLUDED_ENV_VARS = [ + 'DEBUG', + 'DEBUG_MODE', + 'GEMINI_CLI_IDE_SERVER_STDIO_COMMAND', + 'GEMINI_CLI_IDE_SERVER_STDIO_ARGS', +]; const AUTH_ENV_VAR_WHITELIST = [ 'GEMINI_API_KEY',